# Okta SSO Integration

The below video covers setting up Okta SSO with your Cognito User Pool:

{% embed url="<https://www.youtube.com/watch?v=iSFwRqzpXuc>" %}

You can also follow the information and steps below:

This article has been adapted from <https://repost.aws/knowledge-center/cognito-okta-saml-identity-provider>, which contains some legacy or non-applicable information.&#x20;

### Set up Cognito

1. Capture the Congito User Pool ID

In the AWS Console, navigate to the User Pool created by your application. It'll generally look like "CloudStorageSecUserPool-{appid}".

Copy the User Pool ID.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FrVVnrlZTKmOF92n1gLmp%2Fimage.png?alt=media&#x26;token=012466e9-9cf9-4e58-9040-d89c59c2e87e" alt=""><figcaption><p>Cognito User Pool Overview</p></figcaption></figure>

2. In the User Pool, navigate to Domain and select 'Create Cognito Domain'.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FmzKbS2TH4hIl30keJ2fi%2Fimage.png?alt=media&#x26;token=1865b655-651c-48f4-9242-dbad6024788c" alt=""><figcaption></figcaption></figure>

Create the domain of your choice.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FlbZhq4jgmQmpXQKIUzYO%2Fimage.png?alt=media&#x26;token=a4a2e53a-c69d-4127-923a-9cd3aeb45458" alt=""><figcaption></figcaption></figure>

### Create a SAML app in Okta

1. In your Okta dashboard, select Applications > Applications

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FFs6WNZnJYxNXMr3zAFrT%2Fimage.png?alt=media&#x26;token=24fc8f9a-b2b7-4014-9605-cd626a4753ef" alt=""><figcaption></figcaption></figure>

2. Select 'Create App Integration', and in the menu select 'SAML 2.0'
3. Create an app name of your choice. Upload an app logo if you would like. Select 'next'.
4. Configuring SAML:

Here's a chart for the items that must be entered in. After these three values, select 'Next'.

| Key                             | Value                                                                                                                                                                      | Example                                                                                              |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| Single sign-on URL              | enter ' https\://{cognito\_domain\_prefix}.auth.{your\_region}.amazoncognito.com/saml2/idpresponse'. Refer back to the domain created in the 'Create Cognito Domain' step. | <https://css\\_demo.auth.us-west-2.amazoncognito.com/saml2/idpresponse>                              |
| Audience URI                    | enter 'urn:amazon:cognito:sp:{userpoolid}                                                                                                                                  | urn:amazon:cognito:sp:us-west-2\_abcd123                                                             |
| Attribute statements (optional) | for name enter in '<http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress>' and for value enter in 'user.email'                                               | <p><http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress> </p><p></p><p>user.email</p> |

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FQ44Zq15g7nWbDuH68pbZ%2Fimage.png?alt=media&#x26;token=4ef0db29-0f96-42c1-ae5c-354b331fe00b" alt=""><figcaption></figcaption></figure>

5. Provide feedback to Okta if you wish, or just select 'Finish'.

### Assign a user in Okta

1. In the 'Assignments' page, select 'Assign' and 'Assign to People'.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2Fp0DDUPKY2FBsUNoKz62d%2Fimage.png?alt=media&#x26;token=92c5fb3f-83bc-4d06-8251-3b45ed6c2f9e" alt=""><figcaption></figcaption></figure>

2. Select the user you would like to access this application.
3. Select 'Done'.

### Capture Okta IdP metadata

1. Click the 'Sign On' tab and copy the 'Metada URL' value.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FvdWVGtSZpk8vLbG3CSxZ%2Fimage.png?alt=media&#x26;token=b7f5412f-8b89-434e-b4c3-798023423d55" alt=""><figcaption></figcaption></figure>

### Set up Okta in Cognito

In Cognito:

1. Select your user pool
2. Select 'Social and external providers' and select 'Add identity provider'. Select 'SAML'.
3. Fill out 'Okta' as the provider name, and select 'Enter metadata document endpoint URL'. Paste the Metadata URL we copied from the last step.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FwMtRu5WaAbrkrHZsGUxl%2Fimage.png?alt=media&#x26;token=48420efc-7faa-4e39-982d-19b79044c5b0" alt=""><figcaption></figcaption></figure>

4. Add the identity provider.
5. Add an Attribute by clicking 'Edit' on the Attribute Mapping box:

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FIXeZxe7BVMpFm5kQh35b%2Fimage.png?alt=media&#x26;token=3a338703-5c4a-4f81-bd7c-3d85d6800134" alt=""><figcaption></figcaption></figure>

6. Select 'Add another attribute' and enter in the following into the SAML attribute: <http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\\>
   select 'Email' as the User pool attribute.\
   \
   Your form should look like below. Save changes.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FS54MCZeoNWGh9ZVGzhwg%2Fimage.png?alt=media&#x26;token=8512a271-7478-4d15-9b42-15ec8ede0938" alt=""><figcaption></figcaption></figure>

### Configure Cognito App Client

In Cognito > App Clients:

1. Select the 'Login pages' tab and click 'Edit'.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2FIJP6c8Hk8EPY8xuXhf8U%2Fimage.png?alt=media&#x26;token=cc21e36a-337c-4fd9-8bf5-d945671f6fba" alt=""><figcaption></figcaption></figure>

2. In the 'Managed login pages' section, ensure the Allowed callback URLs and Allowed sign-out URLs are both the Console URL.
3. Under 'Identity providers', select 'Okta' and 'Cognito user pool'.
4. Under 'OAuth 2.0 grant types' ensure 'Implicit grant' is selected.
5. Under 'OpenID Connect scopes' ensure 'Email' and 'OpenID' are selected.
6. Save changes.

### CSS Console: Set Up User

1. Click on the 'Sign In With Okta' button. This will create a user in Cognito but permissions need to be initiated first.
2. Log in as a user that has Admin permissions.
3. Go to Access Management -> Manage Users. There will be a new user created with the the format Okta\_{email} in the Manage Users page.
4. Click the 3 buttons next the Status and choose Change Groups. Select Primary and assign the user to the group.

<figure><img src="https://905555942-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlGcQw8I2CHyi1loKBlfi%2Fuploads%2F8bvfpjRemRLKPdoBcomk%2Fimage.png?alt=media&#x26;token=c0d8f5dc-7861-4d40-89c1-4801b6b2d3f4" alt=""><figcaption></figcaption></figure>

5. Enable the user by clicking the button with 3 dots on the rightmost column and selecting 'Enable User'.&#x20;
6. (Optional) Click the 3 buttons next to the Status and choose 'Change Role'. The user defaults at 'User' permissions and can be adjusted to another role if needed.

Your user is now set up! Log out and click the SSO button. You are now logged in as the SSO user!