Page Comparison

...

Anchor
_6hvwpk7vd80q _6hvwpk7vd80q

Add Amazon Cognito as an enterprise application in Azure AD

In this step, you add an Amazon Cognito user pool as an application in Azure AD, to establish a trust relationship between them.

Anchor
_2v8v334poj6j _2v8v334poj6j

To add new application in Azure AD

1. Log in to the Azure Portal.

2. In the Azure Services section, choose Azure Active Directory.

3. In the left sidebar, choose Enterprise applications.

4. Choose New application.

5. On the Browse Azure AD Gallery page, choose Create your own application.

6. Under What’s the name of your app?, enter a name for your application and select Integrate any other application you don’t find in the gallery (Non-gallery), as shown in Figure 1.

7. Choose Create.
   

   

After creating the application in Azure AD, it may take a few moments for the process to complete. Once finished, you will be automatically redirected to the Overview page for the newly added application.

...

Anchor
_utpf0zrtv9jk _utpf0zrtv9jk

To set up Single Sign-on using SAML

1. On the Getting started page, in the Set up single sign on tile, choose Get started, as shown in Figure 2.

   

2. Proceed to the next screen and select SAML.

3. In the middle pane, navigate to the Basic SAML Configuration section, and click on the edit icon.

4. In the right pane, within the Basic SAML Configuration, replace the default Identifier ID (Entity ID) with the Identifier (Entity ID) provided by your account manager. Then, in the Reply URL (Assertion Consumer Service URL) field, input the Reply URL provided by your account manager, as depicted in Figure 3. Click on Save to confirm the changes.

   

5. In the middle pane under Set up Single Sign-On with SAML, in the User Attributes & Claims section, choose Edit.

6. Choose Add a group claim.

7. On the User Attributes & Claims page, in the right pane under Group Claims, select Groups assigned to the application, leave Source attribute as sAMAccountName, as shown in Figure 4.

8. Expand the Advanced options mark the “Customize the name of the group claim” checkbox. Write “groups” in the Name field, as shown in Figure 4 and Choose Save. This will allow automatic GYTPOL roles mapping to Azure AD groups.
   

   

9. Scroll down to the SAML Signing Certificate section and copy the App Federation Metadata URL by choosing the copy into clipboard icon (highlighted with red arrow in Figure 5).

10. Please send the URL to your account manager.

    

11. Assign the application to the relevant groups.

...

Anchor
_mtb4z6701vv3 _mtb4z6701vv3

Configure SAML integration for your Okta app

Create a new App Integration and select SAML 2.0

...

1. Under General Settings, enter a name for your app.

2. (Optional) Upload a logo and choose the visibility settings for your app.

3. Choose Next.

4. Under General, for Single sign on URL, enter the Single sign-on URL provided by your account manager (as Reply URL) and Audience URI (SP Entity ID) which was also provided by your account manager,as shown in Figure 2.

...

Under Attribute Statements (optional), add a statement with the following information, as shown in Figure 3:

...

1. For all other settings on the page, leave them as their default values or set them according to your preferences.

2. Choose Next.

3. Choose a feedback response for Okta Support.

4. Choose Finish.

5. Open the application and under the Sign On page, copy the Metadata-URL and send it to your account manager, as shown in Figure 4.

   

Anchor
_j196whyi9n3l _j196whyi9n3l

Assign a user to your Okta application

1. On the Assignments tab for your Okta app, for Assign, choose Assign to People.

2. Choose Assign next to the user that you want to assign.
   Note: If this is a new account, the only option available is to choose yourself (the admin) as the user.

3. Choose Save and Go Back. Your user is assigned.

4. Choose Done.

...

PingFederate

...

1. Set Up PingFederate as an Identity Provider (IdP):

   • Log in to the PingFederate administrative console.

2. Create an IdP Connection:

   • Navigate to the "Identity Provider" tab.

   • Select "Create New" under "SP Connections".

   • Choose "Browser SSO Profiles" and proceed with the "Next" button.

3. Basic Information:

   • Enter a connection name and an optional description.

   • Click "Next".

4. Connection Type:

   • Select the connection type. Choose "Browser SSO Profiles".

   • Click "Next".

5. Import Metadata:

   • If the Service Provider (SP) provides metadata, you can import it here. Otherwise, select Select "Manual Configuration" and click "Next".

6. Configure the Connection:

   • Connection Options:

     • Choose SAML 2.0 and proceed.

   • Connection Configuration:

     • Enter the Entity ID (e.g., urn:amazon:cognito:sp:eu-central-1_q1W2e3R4).

     • Enter the Assertion Consumer Service (ACS) URL (Reply URL) (e.g., https://gytpol-saas-tenant-name.auth.eu-central-1.amazoncognito.com/saml2/idpresponse

   • SAML Profiles:

     • Enable the SAML profiles required (e.g., SP-initiated SSO).

   • Assertion Lifetime:

     • Set the assertion validity period (default is usually sufficient).

   • Signature Policy:

     • Configure signing options based on SP requirements.

7. Attribute Mapping:

   • Map the attributes from your IdP to the attributes expected by the SP. Common attributes include NameIDnames, email, and others. Please refer to the below screenshots for reference.

   • Click "Next".

...

...

Anchor
_pudjlic4mlam _pudjlic4mlam

When attempting to access the application from the application tile, you're encountering an error message indicating "Invalid samlResponse" or "relayState" from the identity provider.

...