Skip to main content

​
Prerequisites

  • An Auth0 account with admin access to create applications
  • Vikat Enterprise deployed and accessible
  • Your Vikat callback URL: https://<your-vikat-domain>/login
  • Vikat roles created for the roles you plan to map

​
Step 1: Create a regular web application

1

Open the Auth0 dashboard

Sign in to manage.auth0.com.In the left navigation, go to Applications → Applications and click Create Application.
Auth0 Applications page with Create Application button highlighted

Applications page - click Create Application to add a new integration.

2

Choose the application type

Give the app a name - e.g. Vikat OIDC.Select Regular Web Application and click Create.
3

Open the Settings tab

After creating the app, go to the Settings tab. You will see your app’s Domain, Client ID, and Client Secret at the top - keep this tab open as you will need these values later.
Auth0 Vikat OIDC application Settings tab showing the Basic Information section with Domain, Client ID, and Client Secret

Settings tab - Domain, Client ID, and Client Secret are shown here. Keep this tab open.

4

Configure callback URLs

Still on the Settings tab, scroll down to Application URIs and add your login callback to Allowed Callback URLs:
Optionally, to use the Discover Claims feature during Vikat setup, also add:
Discover Claims opens a one-time sign-in popup during configuration so Vikat can inspect the exact JWT your Auth0 tenant sends - useful for verifying the roles claim is present before you build your attribute mappings. You can skip it and add the URL later if needed.
Auth0 application Settings showing Allowed Callback URLs with the Vikat login and SCIM discovery endpoints

Allowed Callback URLs - the login callback is required; the discovery callback is optional and only used during initial setup.

Scroll down and click Save Changes.
5

Copy your credentials

Scroll back up to the top of the Settings tab and copy:
  • Domain - e.g. your-tenant.us.auth0.com
  • Client ID
  • Client Secret (click to reveal)
Auth0 Vikat OIDC application Settings tab showing Domain, Client ID, and Client Secret fields

App credentials - copy Domain, Client ID, and Client Secret. You will need all three when configuring Vikat.

​
Step 2: Add custom claims to the token

Auth0 does not include roles or group memberships in the ID token by default. Use a Post Login Action to inject any attributes you want to map in Vikat. In Actions → Triggers → post-login, create a custom action and add the claims you need. For example, to expose Auth0 roles:
Auth0 action code editor showing the roles claims in token action

Post Login Action — deploy the action and wire it into the post-login flow between Start and Complete.

You can add any other user metadata the same way — event.user.department, event.user.app_metadata.team, etc. Any claim you set here will be available in Vikat’s Attribute Mapping step.
Using a plain claim name (e.g. roles) keeps the mapping simple. If your org policy requires a URL-namespaced claim (e.g. https://your-domain.com/roles), use the full namespaced string as the claim name in Vikat’s attribute mappings.

​
Step 3: Create a Machine-to-Machine app for bulk sync (optional)

This step is only required if you want Vikat to import users in bulk and sync them in the background every 24 hours. If you only need SSO login, skip this step.
1

Create a Machine-to-Machine application

Go to Applications → Applications and click Create Application.Give it a name - e.g. Vikat Bulk Sync - and select Machine to Machine Application.Click Create.
2

Authorize the Management API

On the next screen, select the Auth0 Management API and grant the following scopes:
  • read:users
  • read:user_idp_tokens
  • read:roles
  • read:role_members
Click Authorize.
3

Copy the M2M credentials

Open the Settings tab of your Vikat Bulk Sync app and copy:
  • Client ID
  • Client Secret
Auth0 Vikat Bulk Sync Machine to Machine application Settings tab showing Client ID and Client Secret

Machine-to-Machine app credentials - these are used in Vikat to authorize background user sync via the Auth0 Management API.

​
Step 4: Configure Vikat

1

Open User Provisioning and choose Auth0

In your Vikat dashboard, go to Governance → User Provisioning.Select Auth0 as the identity provider and click Next.
Vikat Choose Provider screen with Auth0 highlighted

Choose Provider - select Auth0 from the list of supported identity providers.

2

Fill in the provider configuration

Enter the credentials you collected in Steps 1 and 3:Click Verify & Next to confirm the connection.
3

Discover claims

On the Attribute Mapping screen, click Discover Claims.Vikat opens a sign-in popup - no session is created. Once you authenticate, it returns the exact claims your Auth0 tenant is sending in the JWT.Confirm that the roles claim is present and contains the expected values before building your mappings.
Vikat Discover Claims screen showing all claims returned by Auth0 including email, roles, and standard OIDC fields

Discover Claims - authenticate once to see the exact JWT claims Auth0 sends, including the roles claim added by your Post Login Action.

4

Set up attribute mappings

Use the sections below the claim list to map Auth0 claim values to Vikat roles, teams, and business units.Attribute-to-Role MappingsMap a claim value to a Vikat role.
  • All matching rules are evaluated - if multiple rules match, the role with the highest permissions is assigned
  • If no rule matches, the user is not assigned a role and login is denied
Attribute-to-Team MappingsMap a claim value to a Vikat team. All matching rules apply.
  • Use a specific value (e.g. engineering) to map that exact claim value to a named Vikat team
  • Use * as the value to sync the claim value directly as the team name
  • Use ${*} to extract part of the string - e.g. Vikat Playground: ${*} Team matches Vikat Playground: Alpha Team and creates team Alpha
Attribute-to-Business Unit MappingsSame wildcard support as team mappings.
  • Use a specific value (e.g. platform) to map that exact claim value to a named Vikat business unit
  • Use ${*} to extract a substring as the business unit name - e.g. Vikat Playground: ${*} BU matches Vikat Playground: Alpha BU and creates business unit Alpha
  • When a rule matches, the resolved business unit is assigned to all of that user’s teams
  • Manually assigned teams are left unchanged
Vikat Attribute Mapping screen showing role mappings (roles = Engineering → Admin, roles = Marketing → Viewer) and team mapping with wildcard

Attribute Mapping - map the roles claim values from Auth0 to Vikat roles, and optionally map groups to teams and business units.

Click Next when done.
5

Review and enable

Review your full configuration on the final screen - connection details, attribute mappings, and SCIM provisioning status - then click Save & Enable.
Vikat Review and Enable screen showing Auth0 domain, Client ID, and attribute mappings summary

Review & Enable - confirm your Auth0 connection details and attribute mappings before activating the provider.

Restart your Vikat server after enabling for the changes to take effect.

​
Troubleshooting

User is not redirected to Auth0 - verify the provider is enabled in Vikat and the server was restarted after saving. Confirm the Auth0 Domain has no trailing slash in the Vikat config. Callback URL mismatch - the redirect URI in Vikat must exactly match one of the Allowed Callback URLs in Auth0. Check for protocol, trailing slash, and path differences. roles claim not appearing in Discover Claims - confirm the Post Login Action is deployed (not just saved as draft) and is connected to the Login flow. Open the Action editor and click Deploy if the status shows Draft. Roles not assigned after login - confirm the user has an Auth0 role assigned under User Management → Users → Roles tab. Only roles from Auth0’s built-in role system are populated by the action code above - custom claims from other sources need a modified action. invalid_token or audience mismatch - leave the Audience field blank in Vikat, or set it to match the aud claim in the JWT (typically the Auth0 Client ID).