SSO and branded logins for a multi-tenant B2B SaaS app

[timonbimon]

Hi there,

We just ran into the "3 enterprise connections"-limit on Auth0 and are looking for a different vendor. Ory looks great on first glance (and I've heard my buddy Max at LuminPDF rave about it), but I haven't been able to figure out how easily it would be able to support our exact use-case.

What we have now

• each customer of ours gets their own "customer1.luminovo.ai" subdomain for their app
• one Auth0 tenant on the B2B plan with the "Organizations" feature (this allows us to easily show the logo of our customer in their respective login page on their subdomain. it would also allow us to easily setup a separate SSO connection for each of our enterprise customers... but only for 3 customers in total, but we have more)
• RBAC permission model (admin and members with different roles for different modules that the customer can buy)
• on the backend we have one Postgres schema per customer with a "app_user" table that stores some user metadata (name, language preference) but not the password (managed through Auth0). On the server we use the permissions stored in the JWT token to check whether a user is allowed to do a certain API call.

The thing I've been most confused about is how best to setup

• showing a different logo on the login UI for each customer (this is a hard requirement, because our customers use our tool to collaborate with their own customers and we are basically white-labelled for them)
• setting up a SSO connections for each different enterprise customers (so they can user their own identity provider to login to our app) => to make things even more complicated we'd need to support both SSO and email/password login (as the our customer's users would use SSO, but the customers of our customers would login on the same subdomain and use an email/password login)

Any help / ideas or just pointers to the right documentation would be greatly appreciated. :)
Merry christmas 🎅
Timon

[timonbimon]

#160 (comment) This is btw exactly how we do "centralized accounts in one Auth0 tenant that are able to login to different customers" (so glad to see that will also work in Ory 🤗).

[vinckr]

Hello Timon,
happy holidays & glad you are checking out Ory.
Have a look at our new Ory to Auth0 migration guide as well, we will add more content to it over time.

The custom logo and OIDC issue you can solve in your custom UI.
I think the best way would be to have a first step where the user inputs their email and then gets accordingly redirected to "their" login UI (or the frontend renders the UI differently).
If sounds like a good idea to you, I can give you some more pointers how to implement it.

Btw did you see ory/elements? We use it as component library for the managed UI and it is a good choice if you build your own.

Feel free to also book a call with us