By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Cognito: Support SSO via OKTA

0

We have an application that uses Amazon Cognito for user authentication. Now, we are planning to support Single Sign-On (SSO) with Okta. I noticed that Cognito offers OIDC and SAML integration. However, when integrating OIDC, we need to provide the client ID, domain, and secret (if required). Since different Okta organizations have different values for these parameters, I am wondering what the Cognito team suggests in this case. We want to support any user from any Okta organization to sign up/sign in to our application, similar to the Sign in with Google functionality.

  • rePost-User-1930055
    a year ago

    One solution is to dynamically create OIDC integration in cognito user pool from the backend by asking client id & domain from the user. However I am wondering if there is something in built cognito provides which I am missing or any standard solution to solve this problem.

Topics
Security, Identity, & Compliance
Tags
Amazon Cognito
Language
English
rePost-User-1930055
asked a year ago270 views
2 Answers
0

Hi there!

I believe this particular use case is not supported. I've looked at the Cognito documentation and there is no mention of this use case.

My guess is that it has to do with Okta working with a per organization model in which there is no general Okta directory of accounts (i.e. in the case of Google, I can personally go and create an account unrelated to any particular organization) that is managed by Okta, except those managed by individual organizations.

I hope this helps (if so, please mark this as an answer).

profile pictureAWS
EXPERT
Jose Guay
answered a year ago
  • rePost-User-1930055
    a year ago

    Yes looks like that however is there any problem to have any number of OIDC providers created by backend runtime ? The solution I mentioned in my post.

  • Jose Guay EXPERT
    a year ago

    You can have multiple Okta instances registered as IdP within the Cognito User Pool. It is the same process as having just one (just rinse and repeat).

0

This tutorial is for SAML Okta/Cognito integration, but you end up with an "Okta Application" that can be reviewed and published inside Okta. I believe any organization should then be able to use it, but I'm not 100% sure.

mtichopad
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content