Okta SSO Integration

This page teaches you how to integrate Okta into your Amazon Cognito User Pool.

The below video covers setting up Okta SSO with your Cognito User Pool:

You can also follow the information and steps below:

This article has been adapted from https://repost.aws/knowledge-center/cognito-okta-saml-identity-provider, which contains some legacy or non-applicable information.

Set up Cognito

1. Capture the Congito User Pool ID

In the AWS Console, navigate to the User Pool created by your application. It'll generally look like "CloudStorageSecUserPool-{appid}".

Copy the User Pool ID.

Cognito User Pool Overview

1. In the User Pool, navigate to Domain and select 'Create Cognito Domain'.

Create the domain of your choice.

Create a SAML app in Okta

1. In your Okta dashboard, select Applications > Applications

1. Select 'Create App Integration', and in the menu select 'SAML 2.0'

2. Create an app name of your choice. Upload an app logo if you would like. Select 'next'.

3. Configuring SAML:

Here's a chart for the items that must be entered in. After these three values, select 'Next'.

Key	Value	Example
Single sign-on URL	enter ' https://{cognito_domain_prefix}.auth.{your_region}.amazoncognito.com/saml2/idpresponse'. Refer back to the domain created in the 'Create Cognito Domain' step.	https://css_demo.auth.us-west-2.amazoncognito.com/saml2/idpresponse
Audience URI	enter 'urn:amazon:cognito:sp:{userpoolid}	urn:amazon:cognito:sp:us-west-2_abcd123
Attribute statements (optional)	for name enter in 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' and for value enter in 'user.email'	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress user.email

1. Provide feedback to Okta if you wish, or just select 'Finish'.

Assign a user in Okta

1. In the 'Assignments' page, select 'Assign' and 'Assign to People'.

1. Select the user you would like to access this application.

2. Select 'Done'.

Capture Okta IdP metadata

1. Click the 'Sign On' tab and copy the 'Metada URL' value.

Set up Okta in Cognito

In Cognito:

1. Select your user pool

2. Select 'Social and external providers' and select 'Add identity provider'. Select 'SAML'.

3. Fill out 'Okta' as the provider name, and select 'Enter metadata document endpoint URL'. Paste the Metadata URL we copied from the last step.

1. Add the identity provider.

2. Add an Attribute by clicking 'Edit' on the Attribute Mapping box:

1. Select 'Add another attribute' and enter in the following into the SAML attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress select 'Email' as the User pool attribute. Your form should look like below. Save changes.

Configure Cognito App Client

In Cognito > App Clients:

1. Select the 'Login pages' tab and click 'Edit'.

1. In the 'Managed login pages' section, ensure the Allowed callback URLs and Allowed sign-out URLs are both the Console URL.

2. Under 'Identity providers', select 'Okta' and 'Cognito user pool'.

3. Under 'OAuth 2.0 grant types' ensure 'Implicit grant' is selected.

4. Under 'OpenID Connect scopes' ensure 'Email' and 'OpenID' are selected.

5. Save changes.

CSS Console: Set Up User

1. Click on the 'Sign In With Okta' button. This will create a user in Cognito but permissions need to be initiated first.

2. Log in as a user that has Admin permissions.

3. Go to Access Management -> Manage Users. There will be a new user created with the the format Okta_{email} in the Manage Users page.

4. Click the 3 buttons next the Status and choose Change Groups. Select Primary and assign the user to the group.

1. Enable the user by clicking the button with 3 dots on the rightmost column and selecting 'Enable User'.

2. (Optional) Click the 3 buttons next to the Status and choose 'Change Role'. The user defaults at 'User' permissions and can be adjusted to another role if needed.

Your user is now set up! Log out and click the SSO button. You are now logged in as the SSO user!