Auth0's internal security team faced a problem that will feel familiar to anyone who has managed authentication across a large organization: twenty separate multi-factor authentication (MFA) vendor portals, each with its own login page, enrollment flow, and audit log. Engineers routinely disabled MFA out of frustration. Audit trails were scattered across unrelated consoles. The team that built a world-class identity platform had created an authentication nightmare for itself.

One engineer proposed a radical simplification: instead of integrating each vendor individually, why not build a single SAML bridge that would let Auth0's own identity platform act as the central authentication gateway? The idea was deceptively simple, but the execution required careful engineering. The result was a dramatic reduction in complexity, cost, and friction.

The MFA Vendor Sprawl That Broke the Security Team

Auth0 relies on a mix of SaaS tools for development, communication, and operations. Each of these tools has its own authentication system. Some support SAML or OpenID Connect; others offer only a proprietary login flow with MFA bolted on. By early 2024, the company counted twenty distinct vendors that required MFA for privileged access—ranging from cloud infrastructure consoles to code repositories to project management tools.

The problem was not just the number of logins. Each vendor had its own MFA enrollment process. Some required hardware tokens; others used TOTP apps; a few pushed notifications to a mobile device. An engineer joining the team might spend an entire afternoon setting up MFA across all twenty services. And when a token expired or a phone was replaced, the recovery process varied wildly—some vendors allowed self-service reset, while others required a support ticket with a 48-hour turnaround.

Frustration led to shortcuts. Internal surveys later revealed that roughly 40% of engineers had disabled MFA on at least one vendor account, usually the ones with the most cumbersome flows. The security team had no centralized way to enforce MFA policies. Audit logs lived in twenty separate consoles, making it nearly impossible to correlate a credential-stuffing attack across services. The team that sold identity solutions to the world had become a case study in vendor sprawl.

The situation was unsustainable, but the obvious fix—building custom integrations for each vendor—would have taken months and required ongoing maintenance.

Why a SAML Bridge Beat a Dozen Custom Integrations

The team evaluated multiple approaches. One option was to build a custom API integration for each vendor, essentially writing a shim that translated Auth0's authentication requests into each vendor's native format. That would have required maintaining twenty separate connectors, each with its own rate limits, error handling, and update cadence. Another option was to use a third-party identity aggregation service, but that introduced another vendor into the stack—and another set of credentials to manage.

The winning proposal came from a senior engineer who pointed out that 18 of the 20 vendors already supported SAML 2.0 for single sign-on. SAML, or Security Assertion Markup Language, is a widely adopted standard for exchanging authentication and authorization data between identity providers (IdPs) and service providers (SPs). Instead of forcing each vendor to talk to Auth0 directly, Auth0 could act as the IdP, and each vendor could be configured as an SP that trusts Auth0's assertions.

The remaining two vendors—a legacy code-hosting platform and a monitoring tool—did not support SAML. For those, the team built lightweight reverse proxies that intercepted login requests and injected SAML assertions into the vendor's proprietary flow. The proxies were fewer than 200 lines of code each and required minimal maintenance.

Auth0's own platform already had robust SAML support, including the ability to define custom attribute mappings and signing certificates. The team realized they could use Auth0's Actions pipeline—a serverless execution environment that runs custom code during the authentication flow—to enforce conditional access policies per vendor. For example, a vendor handling sensitive customer data could require phishing-resistant MFA (WebAuthn), while a low-risk internal tool could accept TOTP.

How Auth0’s Engineering Team Built the Connector

The project was staffed with two engineers for six weeks. They worked on a dedicated branch of Auth0's internal tenant, using the same platform that Auth0 sells to customers. This dogfooding approach meant that any bug they fixed or feature they added would benefit external customers as well. The team mapped each vendor's SAML attribute requirements—some vendors expected an email address in the NameID field, while others wanted a username or a custom attribute like employee_id.

They stored per-vendor MFA preferences in Auth0's app_metadata, a JSON object attached to each user profile. When a user initiated a login to, say, the cloud console, Auth0's Actions pipeline would read the vendor's MFA requirement from app_metadata and enforce the corresponding policy. If the vendor required hardware-backed MFA and the user had only TOTP enrolled, the login would be blocked with a clear error message guiding the user to enroll the required factor.

The rollout followed a phased pattern. The first week, only the engineering team's own accounts were migrated. The second week, the security team joined. By week four, all internal users were on the new bridge. The team monitored login success rates, error logs, and support tickets closely. A handful of users encountered issues with SAML attribute mismatches—a vendor expected a lowercase email but received a mixed-case one—which were fixed by adjusting the attribute mapping.

One unexpected challenge was session duration. Some vendors enforced a maximum session length of 8 hours, while others allowed up to 30 days. The team had to configure Auth0's session settings to respect the most restrictive vendor, then use refresh tokens to re-authenticate silently for longer-lived sessions. This required coordination with each vendor's support team to understand their session policies.

The Authentication Flow That Replaced Twenty Logins

An engineer navigates to, say, the cloud console URL. Instead of seeing the vendor's login page, they are redirected to Auth0's universal login page. They authenticate once—typically with a corporate password and a WebAuthn security key—and Auth0 generates a SAML assertion containing their identity and any required attributes. The assertion is signed with Auth0's private key and sent to the vendor's SAML endpoint.

The vendor validates the assertion, creates a local session, and redirects the user to the application. The user never sees the vendor's login screen again. If the vendor requires step-up authentication—for example, because the user is accessing a sensitive project—Auth0's Actions pipeline can trigger an additional MFA challenge before releasing the assertion. The entire process takes under two seconds in most cases.

Logout is handled similarly. When a user logs out of Auth0, the platform sends a SAML logout request to each vendor that the user has an active session with. The vendors terminate their local sessions, and the user is redirected to a confirmation page. This global logout was one of the most requested features during the pilot, as users had previously needed to log out of each vendor individually.

The bridge also improved auditability. Instead of checking twenty separate audit logs, the security team could now view all authentication events in Auth0's unified logs. Each event included the vendor name, the user's identity, the MFA method used, and the risk score (if any). A security analyst could search for all logins to a particular vendor within seconds, something that had previously taken hours of manual cross-referencing.

Lessons for Any Team Drowning in Vendor Logins

The most important lesson is to audit each vendor's federation capabilities before committing to a custom integration. Many vendors support SAML or OIDC even if they don't advertise it prominently. A quick check of the vendor's documentation or a conversation with their support team can save weeks of development. In Auth0's case, the team found that two vendors they assumed lacked SAML actually supported it in their enterprise plans, which they were already paying for.

Prefer standards-based protocols over custom APIs. SAML and OIDC are mature, well-tested standards with broad support. Custom APIs, while sometimes necessary, introduce coupling to a vendor's internal implementation, which can break without warning. The two vendors that required custom proxies were both legacy products with no plans to adopt modern federation. The team accepted that risk but isolated the proxy code in a separate module with its own test suite.

Plan for vendors that lack SAML support. A lightweight reverse proxy or a browser extension can often bridge the gap. The team's proxies were minimal—they intercepted the login form submission, extracted the credentials, and replaced them with a SAML assertion. This approach is fragile if the vendor changes their login page, but the team mitigated that by writing integration tests that ran daily against the vendor's staging environment.

Test MFA recovery paths before production cutover. One of the biggest pain points in the old system was recovering from a lost token or phone. The team made sure that every vendor's SAML configuration included a way to trigger a password reset or MFA re-enrollment from Auth0. They also documented the recovery procedure for each vendor and tested it with a subset of users before the full rollout.

Document metadata exchange with each partner. SAML relies on exchanging XML metadata that includes endpoints, certificates, and attribute mappings. The team created a shared spreadsheet with each vendor's metadata URL, signing certificate fingerprint, and supported attributes. This proved invaluable when a vendor rotated their certificate—a quick update to the spreadsheet and a configuration change in Auth0 kept the bridge running.

The Security Gains Nobody Expected

The most dramatic improvement was MFA adoption. Before the bridge, internal surveys estimated that only 40% of vendor accounts had MFA enabled. After the bridge, that number climbed to 98%. The remaining 2% were service accounts that could not use interactive MFA, which were protected by IP allowlists and short-lived access tokens. The team had not predicted such a rapid adoption, but the convenience of a single login flow removed the friction that had led engineers to disable MFA.

Centralized logging caught a credential-stuffing attack within the first month. An attacker had obtained a list of email addresses from a previous data breach and was attempting to log in to the code repository vendor. Because all authentication events were now funneled through Auth0, the security team saw a spike in failed login attempts from a single IP range. They blocked the IPs at the network level and forced password resets for all affected accounts. Under the old system, the attack might have gone unnoticed for weeks.

The attack surface also shrank. Previously, each vendor's login page was publicly accessible and could be targeted individually. After the bridge, only Auth0's universal login page was exposed. The vendors' login pages were either disabled or configured to accept only SAML assertions from Auth0's IP range. This reduced the number of externally visible authentication endpoints from twenty to one.

Phishing-resistant MFA became enforceable per application. The team could require WebAuthn for high-risk vendors while allowing TOTP for low-risk ones. This granularity was impossible before, as each vendor had its own MFA settings. The bridge also made it easier to rotate credentials: when a user lost a security key, they could enroll a new one in Auth0, and all vendors would automatically use the new key for step-up challenges.

Incident response time dropped from hours to minutes. When a user reported suspicious activity, the security team could pull up their Auth0 logs, see every vendor login in the last 24 hours, and determine whether the activity was legitimate. In one case, a user's account was compromised because they had reused a password from a third-party breach. The team identified the compromised vendor—a project management tool—and revoked the user's session within five minutes. Under the old system, they would have had to contact each vendor's support team individually.

Why This Approach Generalizes Beyond Auth0

Any identity provider that supports SAML or OIDC can replicate this pattern. Okta, Azure AD, Ping Identity, and many others offer similar bridging capabilities. The key is to treat the IdP as a policy enforcement point, not just a credential store. The SAML bridge pattern is particularly effective for organizations with 10–50 vendors, where the cost of building custom integrations outweighs the effort of configuring SAML on each vendor.

The cost of integration is often recouped in weeks. Auth0's engineering team spent six weeks building the bridge. In the first month alone, the reduction in support tickets for MFA-related issues saved roughly 40 hours of helpdesk time. The centralized logging also reduced the time spent on audit compliance—a quarterly requirement that previously took a full week of manual log collection now took a single dashboard query.

The approach reduces vendor lock-in for authentication decisions. If a vendor's MFA implementation is subpar, the organization can enforce its own MFA policy at the IdP level without relying on the vendor. This is especially valuable for vendors that charge extra for advanced MFA features. By handling MFA at the IdP, organizations can standardize on a single factor type—say, WebAuthn—and avoid paying for each vendor's premium MFA tier.

The pattern scales to hundreds of service providers. The team later extended the bridge to cover internal applications and non-SaaS tools, bringing the total number of connected SPs to over 60. Each new integration required roughly two hours of configuration, down from the two days it would have taken to build a custom integration. The SAML bridge did not eliminate all vendor integration work, but it reduced it to a fraction of the original effort.

Not everything is perfect. Some vendors still lack SAML support, and the lightweight proxy approach is brittle. The team continues to push vendors to adopt modern federation standards, and they have replaced two of the original proxy-wrapped vendors with native SAML integrations as the vendors updated their platforms. The bridge also introduces a single point of failure: if Auth0 goes down, all vendor logins are blocked. The team mitigated this with a fallback that allows users to log in directly to critical vendors using backup codes, but the risk remains.

Still, the experiment demonstrated that a small team can dramatically reduce authentication complexity by leveraging standards and a platform they already owned. For any security team staring down a list of a dozen vendor login pages, the lesson is straightforward: invest in a SAML bridge, and let the IdP do the heavy lifting.