How to add Okta as a SAML Identity Provider in AWS Cognito?

This video explains the steps to add Okta as a SAML Identity Provider in AWS Cognito. It also simulates a multi-tenant app.
To add Okta as a OIDC Identity Provider in AWS Cognito, please follow this video • How to add Okta as a O...
Refer this blog / how-to-add-okta-as-sam... for more details
#identity #iam #security #sso #aws #amazonwebservices #cognito #saml #awscognito #amazoncognito

[@securityinaction1018]

Please subscribe to this channel for regular updates kzbin.info/door/EEayyyCrJO94FYlzF0NLTg Thank You for the support.

[@ianlamb1910]

You absolute hero, I had an issue with my mappings that the AWS documentation had incorrectly told me to follow. Your advice has fixed this for me, brilliant video well done and thank you!

[@securityinaction1018]

Glad it helped!

[@ciaranmcgauran8367]

Thank you for this really clear walk through. Much appreciated.

[@securityinaction1018]

Glad it was helpful! Please like, subscribe & share!! Thanks in advance.

[@JohnDoe-z3y]

How do I buy you a drink man? Your videos are great! Right on!

[@securityinaction1018]

Any time! 🙂

[@nehachaurasia5958]

Very helpful and Informative.

[@securityinaction1018]

Glad it was helpful!

[@2mitaly]

Great tutorial! Thanks a lot!

[@securityinaction1018]

Glad it was helpful!

[@daraptoor]

You save my day :)

[@securityinaction1018]

Glad it helped :)

[@RahulKashyap-f7r]

very useful thanks

[@securityinaction1018]

Glad it was helpful!

[@AleksandarT10]

I have an use case where we want to use Cognito with OKTA using SAML. Since our application needs to have ROLES/SCOPES where we control who can access what, is it possible to configure this in Okta (something like roles/permissions/custom attributes?) and they are passed to Cognito and be as part of the token? Great video! Keep up the good work!

[@securityinaction1018]

I am sure there should be some way to pass the Okta roles in a SAML attribute and then map that to a custom Cognito userpool attribute. This custom attribute can be added in the Cognito's ID token.

[@AleksandarT10]

@@securityinaction1018 I managed to do that just now, added "groups" attribute and included all the groups the user belongs to, and after that i am mapping it to custom Cognito User Pool attribute and that appears in the ID token. Is it possible for somehow to appear in the access token? Because i will have to use ID tokens to do my Authentication/Authorization, which "apparently" is not a good practice based on some people on the internet

[@securityinaction1018]

I don't think that is possible at this point of time unless those groups are present in Cognito and users are added to those cognito groups.

[@chandanb8182]

@@AleksandarT10 Can you provide me the steps on how we can show okta groups in ID token. I'm not able to see it in the ID token. I have created a group in okta and assigned the user as well. In cognito I created the custom user attribute custom:appgroups and mapped it to okta group name admingroup. But still the group is not showing up

[@DhirenSahu-v6y]

The video is excellent. It worked for authentication but the User was not got created automatically in the user pool. Can you please guide?

[@securityinaction1018]

Please check the users tab in the Cognito user pool. If it doesn't show up, refresh the page.

[@DhirenSahu-v6y]

I refreshed as Users have not got created, reaching out to you for your guidance. One more point, it created a group with UserPool Id_Okta Domain name without any user. @@securityinaction1018

[@securityinaction1018]

That's surprising. Are you getting an ID token ? If so, a user profile should be present. But, I am not sure why it is not showing up even after refreshing. May be you can try opening the console in different browsers or incognito window.

[@chandanb8182]

Hi, Can you make a video with Authorization code grant flow instead of implicit grant flow and how we can use it in our application

[@securityinaction1018]

Please refer this video which talks about authorization code grant flow using Okta kzbin.info/www/bejne/p2aZeqJpbtFmp8k

[@chandanb8182]

how can we generate access token with okta or cognito groups in the access token

[@securityinaction1018]

Cognito groups are already available in Access Token in "cognito:groups" claim. Refer this documentation for more details docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html

[@chandanb8182]

@@securityinaction1018 I need to get the groups from okta, how to get the groups from okta within the access and ID token.

[@securityinaction1018]

Refer support.okta.com/help/s/article/How-to-pass-a-user-s-group-membership-in-a-SAML-Assertion-from-Okta?language=en_US. I have not tried this. You can map the Okta SAML attribute that has group details to a custom attribute in Cognito user profile. This custom attribute will get added as a claim in the ID token, but not access token.

[@PiyushKumar-js1ww]

Hi , This is very informative video , could you help me with add keycloak as SAML Identity Provider in aws cognito if you have any reference or setup guide.

[@securityinaction1018]

I will check keycloak and publish a video in future

[@securityinaction1018]

I added a new video on how to configure Keycloak as SAML IdP in Cognito. kzbin.info/www/bejne/e3e3XmaKfLGbkNk

[@dipakchaudhari-f6j]

Can we get access for okta and cognito pool both users by same email & password form??

[@securityinaction1018]

If I understand the question correctly, you want to authenticate both okta and cognito pool users using the same login form. If so, that is not possible because Okta profiles are stored within Okta user data store and similarly, Cognito users in Cognito's user data store. Federation is the best way to handle this.

[@dipakchaudhari-f6j]

After redirecting with JWT token How can I decrypt the token in Javascript. Which npm package should be use and for decryption from where I can get the keys??

[@securityinaction1018]

Hi Dipak, refer this documentation for more details docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-verifying-a-jwt.html#amazon-cognito-user-pools-using-tokens-aws-jwt-verify. It has all the details that you asked.

[@dipakchaudhari-f6j]

​@@securityinaction1018 As per video we don't set federation by clicking seperate link 'Federated Identities' in aws cognito service. Now I'm using 'aws-amplify' package where 'federatedSignIn' method required identity_id e.g. eu-north-1:8e2f0d8e-3014-41da-977b-7c7e28fba44a . How can I provide this ID by creating new federation it shows error 'unknown federation id'

[@securityinaction1018]

I have not used amplify library. If you can point out to the exact documentation, I can take a look and let you know. Also, can you explain the requirement? Do you want to bypass the Cognito login page and redirect to the external IdP login page?