Cognito: Support SSO via OKTA

0

We have an application that uses Amazon Cognito for user authentication. Now, we are planning to support Single Sign-On (SSO) with Okta. I noticed that Cognito offers OIDC and SAML integration. However, when integrating OIDC, we need to provide the client ID, domain, and secret (if required). Since different Okta organizations have different values for these parameters, I am wondering what the Cognito team suggests in this case. We want to support any user from any Okta organization to sign up/sign in to our application, similar to the Sign in with Google functionality.

  • One solution is to dynamically create OIDC integration in cognito user pool from the backend by asking client id & domain from the user. However I am wondering if there is something in built cognito provides which I am missing or any standard solution to solve this problem.

demandé il y a un an283 vues
2 réponses
0

Hi there!

I believe this particular use case is not supported. I've looked at the Cognito documentation and there is no mention of this use case.

My guess is that it has to do with Okta working with a per organization model in which there is no general Okta directory of accounts (i.e. in the case of Google, I can personally go and create an account unrelated to any particular organization) that is managed by Okta, except those managed by individual organizations.

I hope this helps (if so, please mark this as an answer).

profile pictureAWS
EXPERT
répondu il y a un an
  • Yes looks like that however is there any problem to have any number of OIDC providers created by backend runtime ? The solution I mentioned in my post.

  • You can have multiple Okta instances registered as IdP within the Cognito User Pool. It is the same process as having just one (just rinse and repeat).

0

This tutorial is for SAML Okta/Cognito integration, but you end up with an "Okta Application" that can be reviewed and published inside Okta. I believe any organization should then be able to use it, but I'm not 100% sure.

répondu il y a un an

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions