Log in to your Auth0 account and head to your dashboard. Select Applications → Applications on the left menu. On the Applications page, click the Create Application button to create a new app.
Create Regular Web Application
On the Create New Application page, name your application and select the Regular Web Application for your application. This is the application that your users will login to.
Under the Settings tab, note the Domain, Client ID, and Client Secret values. We'll provide these to Pomerium at the end of the process.
Provide the following information for your application settings:
Field Description Name The name of your application. Application Login URI Authenticate Service URL (e.g.
Allowed Callback URLs Redirect URL (e.g.
Under Advanced Settings → OAuth, confirm that JSON Web Token (JWT) Signature Algorithm is set to "RS256".
Click Save Changes at the bottom of the page when you're done.
Next, we'll create an application to handle machine-to-machine communication from Pomerium to Auth0 in order to retrieve and establish group membership.
Auth0 refers to groups as roles.
Repeat the process in step 1 above to create a new application, but this time select Machine to Machine Application. A different application is used for grabbing roles to keep things more secure.
On the next page select Auth0 Management API from the dropdown. Under Permissions use the filter on the right to narrow things down to
role, and choose the
Then click Authorize.
Just like the previous step, retrieve the Client ID and Client Secret from the Settings tab. To build the
idp_service_accountvalue for Pomerium's configuration, you must base64-encode a JSON document containing the Client ID and Client Secret of the application:
If you save this JSON document as a temporary file, you can encode it like this:
cat json.tmp | base64 -w 0
You can now configure Pomerium with the identity provider settings retrieved in the previous steps. Your
config.yaml keys or environmental variables should look something like this.
- Environment Variables
idp_client_id: "REPLACE_ME" # from the web application
idp_client_secret: "REPLACE_ME" # from the web application
idp_service_acount: "REPLACE_ME" # built from the machine-to-machine application, base64-encoded
IDP_CLIENT_ID="REPLACE_ME" # from the web application
IDP_CLIENT_SECRET="REPLACE_ME" # from the web application
IDP_SERVICE_ACCOUNT="REPLACE_ME" # built from the machine-to-machine application, base64-encoded
Remember to prepend the provider URL from Auth0 with