{"id":20844534,"url":"https://github.com/pushpabrol/saml-idp-migration-to-auth0","last_synced_at":"2026-03-19T17:48:13.049Z","repository":{"id":92530016,"uuid":"521423074","full_name":"pushpabrol/saml-idp-migration-to-auth0","owner":"pushpabrol","description":"This repo contains instructions on how to migrate SAML IDP from an platform like PING or Other to Auth0","archived":false,"fork":false,"pushed_at":"2022-08-16T20:50:17.000Z","size":9,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-19T04:34:09.911Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pushpabrol.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-04T21:40:46.000Z","updated_at":"2023-07-31T18:34:26.000Z","dependencies_parsed_at":null,"dependency_job_id":"4273c74c-8d31-428e-908c-cd1e36abba66","html_url":"https://github.com/pushpabrol/saml-idp-migration-to-auth0","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pushpabrol%2Fsaml-idp-migration-to-auth0","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pushpabrol%2Fsaml-idp-migration-to-auth0/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pushpabrol%2Fsaml-idp-migration-to-auth0/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pushpabrol%2Fsaml-idp-migration-to-auth0/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pushpabrol","download_url":"https://codeload.github.com/pushpabrol/saml-idp-migration-to-auth0/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243205234,"owners_count":20253427,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T02:09:54.074Z","updated_at":"2026-03-11T19:04:11.495Z","avatar_url":"https://github.com/pushpabrol.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# saml-idp-migration-auth0\nThis repo contains instructions on how to migrate SAML IDP from an platform like PING or Other to Auth0\n\n\n## Problem statement\nA customer that is using a third party IDP has setup 100s of SAML IDPs/Enterprise Connections. They want to migrate to Okta CIC but do not want to cause any changes for the partners/customers with whom they exchanged metadata to establish the IDP trust. The manual work involved with this setup is very high therefore a migration which allows this to happen with low touch is desirable\n\n\n## How do we solve this?\n  \n    \n  - The solution involves creating a proxy that runs on the ACS url for the Service Provider (source) and reposts the SAML response to the destination Service Provider\n  \n  \u003cimg width=\"738\" alt=\"image\" src=\"https://user-images.githubusercontent.com/7750618/182960288-2f84d4f6-4175-4a5e-b88f-001d956e791d.png\"\u003e\n  \n  \n  - Flow before routing\n    \u003cimg width=\"1037\" alt=\"image\" src=\"https://user-images.githubusercontent.com/7750618/182974049-ea7ff3db-bcc9-4bdc-b127-88d037dad5d2.png\"\u003e\n\n  - Flow after routing is enabled via the proxy\n  ![image](https://user-images.githubusercontent.com/7750618/183534744-6fd08734-e65d-416c-9db8-c4d2a3db2247.png)\n\n\n  \n  \n  - Since this solution is in the middle of a SAML Authentication Response there are several key prerequisites for this to work.\n    - Prerequisites:\n      1. Each SAML IDP has a unique Entity ID\n      2. Each SAML IDP has a unique ACS Url for the Source SP\n      3. Each SAML IDP is not requiring a Signed Authentication Request from the SP (source) for SP initiated flows\n      4. Each SAML IDP does not encrypt the SAML response uisng the public key of the SP (source)\n      \n      \n  ## Source projects that contain the required code for this solution\n  \n  - The proxy source code that re-routes the SAML Response\n    1. For this example we are using cloudflare as the proxy\n    2. [Source code](https://github.com/pushpabrol/cf-worker-saml-proxy-externalsp-auth0)\n\n  - The code using the Auth0 Management API to create the IDP/Enterprise SAML Connection\n    1. [Source code](https://github.com/pushpabrol/auth0-create-saml-connection)\n\n  - See the README within each project for steps\n  - It is important to understand that in Auth0 we are disabling some of the checks such as destination and recipient to allow this to function\n\n    \n    \n      \n   \n      \n      \n      \n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpushpabrol%2Fsaml-idp-migration-to-auth0","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpushpabrol%2Fsaml-idp-migration-to-auth0","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpushpabrol%2Fsaml-idp-migration-to-auth0/lists"}