> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/global-settings/security/identity-providers-sso/oidc-identity-providers/aws-cognito-oidc-configuration.md).

# AWS Cognito - OIDC - Configuration

{% hint style="success" %}

#### Required User Credentials

\[**Flosum User**] - **SystemAdministrator** Role
{% endhint %}

{% hint style="success" %}

#### Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.
{% endhint %}

## ![](https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FSxcnKlaJKPzDqONWoDNv%2FSummary2-Small-Icon.svg?alt=media\&token=5e3253d0-a069-4ba5-9c06-83c70bd0b21d) Overview

This guide explains how to integrate AWS Cognito using OpenID Connect (OIDC) with Flosum Cloud Apps to enable Single Sign-On (SSO) for seamless login.

{% hint style="info" %}
For more general instructions about adding an Identity Provider, see the following article.

* [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
  {% endhint %}

{% hint style="warning" %}

#### Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any **Flosum Hosted URLs** with your own URLs.
{% endhint %}

### Outline Of Steps Involved

* **Create a User Pool with AWS Cognito**
* **Determine Issuer URL**
* **Obtain the Client ID and Client Secret**
* **Set up the Redirect URL**
* **Create an Identity Provider with Flosum Global Settings**
* **Test the SSO**

## Configuring AWS Cognito for Flosum Cloud Apps

This section shows you how to configure an AWS Cognito User Pool to work with Flosum Cloud Apps for SSO.

{% hint style="warning" %}
Please note that the instructions for AWS Cognito may not reflect the latest version. Some screens, field names, and steps might have changed.
{% endhint %}

{% stepper %}
{% step %}

### Create AWS Cognito User Pool

1. Access the **AWS Management Console** and navigate to the **Cognito service**. 
2. Select **Manage User Pools**. 
3. In the User Pools section, click the **Create a User Pool** button. You'll be prompted to name your new pool. 
4. After naming your pool, select **Step through settings**. This section lets you define sign-in parameters for your users. 
5. Select the attributes shown in the screenshot below. These attributes determine the information you'll collect from users during registration. 

   <div align="left"><figure><img src="https://lh5.googleusercontent.com/VrEigrVn_qHOOVG78O96BmwWZtHsQC2g_HF1Kb-p9DHrI2A97IJnD0bV0sb3O7NAI5c3BOQNrXntiv9eH-P_f9e1KDvff1DabFRmQoe20D_27Iqd_v2dNfKHE4IOHifQB3mXj_bp_OLW2c9l" alt="" width="563"><figcaption></figcaption></figure></div>
6. After setting the required attributes, click **Next Step** to save your configurations.
   {% endstep %}

{% step %}

### Setting Up Policies

1. Select the settings to match your security requirements.&#x20;
2. Click **Next Step**.&#x20;

   <div align="left"><figure><img src="https://lh6.googleusercontent.com/TlUHlReogVC74GD12VbRBr3S6NyPZN_auoA8wb7WdMJqoo4KCvhcpgmtfkdT4FgH1YTmflUYLu4rUDmbGjPUo5UlhqF_p42IERIDvwKdXdiS2UAmqRTJOlxaVIloHDJzq4-uxFhEoCoTDhw9" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### MFA and Verification Configuration

1. Select Multi-Factor Authentication and verification settings based on your security needs.&#x20;
2. Click **Next Step** to save your configurations.

   <div align="left"><figure><img src="https://lh6.googleusercontent.com/JCtcza0AHiQoH2DrdSzJEFqL40XDbkVhCoPSZBbmxZ-m7yH486IilOlqqoI0Ijtm1vV_nXPcDa_u3RMSdGSrJIRIfpOcf5IFWMbU5MAKnJxd7YpsmM8OuFUrjby_J9sZrWvssJuXodUPeI9b" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Message Customizations

1. Edit the verification messages to meet your needs.
2. Click **Next Step** to save your configurations.&#x20;

   <div align="left"><figure><img src="https://lh4.googleusercontent.com/p8HDSG-2n_7jHhpe0aM7u46G7fRNXqbwjCeW9arIkKYClXm7S76kOZ3BqUCT5dTusz8vCyWXiU4theC1p-z9EsX08iEOwV9xnIm2CFNYqVBaB_sLPg3CZSGWQpLGilqVHQzsMquhYaxglVUO" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### App Clients Configuration

1. Skip the **Tags** and **Devices** steps.
2. Configure the **App Clients**.
3. Click **Add an app client**.&#x20;
4. Edit the settings to match the screenshot below.
5. Click **Next Step** to save your configurations.&#x20;

   <div align="left"><figure><img src="https://lh5.googleusercontent.com/mO6HsG5hIak9alvEimEb6oGOnNS04UzsoAao1wGZCyqVCkf8EZl8Kq8s1UUeQgcVAh3yyNiZNOZ80ylRfKmXhTtKpp61CRkhq494tmgySc2FMU0wkm20DXSY8Lb1f6LH8H0BDd3VdV9UiqIp" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Finalize the User Pool

1. On the **Review** step, verify all configurations are correct.
2. If everything is correct, click **Create Pool** to finalize the user pool creation.
   {% endstep %}

{% step %}

### Set the Domain Name

The next step is to create a **Domain Name** for the User Pool you created.&#x20;

1. Navigate to the **Domain Name** tab.
2. Enter your desired **Domain Prefix**.
3. Click **Check Availability**.&#x20;
4. If the domain is available, click **Save Changes**.&#x20;

   <div align="left"><figure><img src="https://lh3.googleusercontent.com/1DlPH2O3OuUJYZr1iu3UT2IFI0WCzzwshDrsIIBTo9_nU5nfzSR-xnP8Q-waLx1OO8ciHZt2XfP907uflygDRz4J38TL9SHb7jnb3RenaeMHWRy1aQuWOwNsbRIhzLJ4RWqC4K7G33mXbkk0" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Configure App Client Settings

1. Navigate to **App client settings** and update them to match the configurations shown in the screenshot below.&#x20;

   <div align="left"><figure><img src="https://lh6.googleusercontent.com/puQp5uimq39Qyxg6OXnc-2WsDmudmQW5LZWtrKkfTmlLQ4RpXPf-0uTd_eo9Fkvze9h1IhekEZvxz8l3sjfgyWdCT2dwZkIZmeCdDb1aMAqdTU2bOxMYeayJOy_UVfdxeWEyweI4GKL2n7Dx" alt="" width="563"><figcaption></figcaption></figure></div>
2. In the **CallBack URL(s)** field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

{% tabs %}
{% tab title="United States URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-us.flosum.app/api/v1/oauth/callback</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-us.flosum.app/api/v1/oauth/callback</td></tr><tr><td>DevOps</td><td>https://devops-us.flosum.app/api/v1/oauth/callback</td></tr></tbody></table>
{% endtab %}

{% tab title="Germany URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-de.flosum.app/api/v1/oauth/callback</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-de.flosum.app/api/v1/oauth/callback</td></tr><tr><td>DevOps</td><td>https://devops-de.flosum.app/api/v1/oauth/callback</td></tr></tbody></table>
{% endtab %}

{% tab title="Japan URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-jp.flosum.app/api/v1/oauth/callback</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-jp.flosum.app/api/v1/oauth/callback</td></tr><tr><td>DevOps</td><td>https://devops-jp.flosum.app/api/v1/oauth/callback</td></tr></tbody></table>
{% endtab %}

{% tab title="Australia URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-au.flosum.app/api/v1/oauth/callback</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-au.flosum.app/api/v1/oauth/callback</td></tr><tr><td>DevOps</td><td>https://devops-au.flosum.app/api/v1/oauth/callback</td></tr></tbody></table>
{% endtab %}
{% endtabs %}

3. In the **Sign-out URL(s)** field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

{% tabs %}
{% tab title="United States URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Sign-Out URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-us.flosum.app/api/v1/oauth/login</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-us.flosum.app/api/v1/oauth/login</td></tr><tr><td>DevOps</td><td>https://devops-us.flosum.app/api/v1/oauth/login</td></tr></tbody></table>
{% endtab %}

{% tab title="Germany URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Sign-Out URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-de.flosum.app/api/v1/oauth/login</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-de.flosum.app/api/v1/oauth/login</td></tr><tr><td>DevOps</td><td>https://devops-de.flosum.app/api/v1/oauth/login</td></tr></tbody></table>
{% endtab %}

{% tab title="Japan URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Sign-Out URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-jp.flosum.app/api/v1/oauth/login</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-jp.flosum.app/api/v1/oauth/login</td></tr><tr><td>DevOps</td><td>https://devops-jp.flosum.app/api/v1/oauth/login</td></tr></tbody></table>
{% endtab %}

{% tab title="Australia URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Sign-Out URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-au.flosum.app/api/v1/oauth/login</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-au.flosum.app/api/v1/oauth/login</td></tr><tr><td>DevOps</td><td>https://devops-au.flosum.app/api/v1/oauth/login</td></tr></tbody></table>
{% endtab %}
{% endtabs %}
{% endstep %}

{% step %}

### Retrieve the ISSUER\_BASE\_URL

{% hint style="info" %}
You will need the **ISSUER\_BASE\_URL** value when creating the Identity Provider in Flosum Global Settings.
{% endhint %}

1. Navigate to **Manage User Pools** within AWS Cognito.
2. Select the User Pool you created, and then access **General Settings**.
3. Note the **ISSUER\_BASE\_URL**, which follows the format: `https://cognito-idp.<region>.amazonaws.com/<userPoolId>`.&#x20;

   <div align="left"><figure><img src="https://lh6.googleusercontent.com/zsWrLhvp05cCmhOZK7lX1vxgy1Hfe04OcI_HBOLlgRnd5q738Kz3aHPpFOTEEBrN8xaCCFMKHtAu6OhUuJ72R03EV_sX9Embgni5z26EmA1HxdZITDswWgbZ9AK3TIrVyHTjWB-y2OkFKcYG" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Retrieve ISSUER\_CLIENT\_ID and ISSUER\_CLIENT\_SECRET

{% hint style="info" %}
You will need the **ISSUER\_CLIENT\_ID** and **ISSUER\_CLIENT\_SECRET** values when creating the Identity Provider in Flosum Global Settings.
{% endhint %}

1. Navigate to **Manage User Pools** within AWS Cognito.
2. Select the User Pool you created, and then click on **App Clients**.
3. Note the **ISSUER\_CLIENT\_ID**, found under App client id.
4. Note the **ISSUER\_CLIENT\_SECRET**, found under App client secret.
   {% endstep %}

{% step %}

### Set Redirect URL

1. In the **Redirect URL** field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

{% tabs %}
{% tab title="United States URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-us.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-us.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>DevOps</td><td>https://devops-us.flosum.app/api/v1/auth/login/open-id</td></tr></tbody></table>
{% endtab %}

{% tab title="Germany URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-de.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-de.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>DevOps</td><td>https://devops-de.flosum.app/api/v1/auth/login/open-id</td></tr></tbody></table>
{% endtab %}

{% tab title="Japan URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-jp.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-jp.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>DevOps</td><td>https://devops-jp.flosum.app/api/v1/auth/login/open-id</td></tr></tbody></table>
{% endtab %}

{% tab title="Australia URLs" %}

<table><thead><tr><th width="180">Flosum Cloud App</th><th>Callback URL</th></tr></thead><tbody><tr><td>Global Settings</td><td>https://global-au.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>Backup &#x26; Archive</td><td>https://backup-au.flosum.app/api/v1/auth/login/open-id</td></tr><tr><td>DevOps</td><td>https://devops-au.flosum.app/api/v1/auth/login/open-id</td></tr></tbody></table>
{% endtab %}
{% endtabs %}
{% endstep %}
{% endstepper %}

## Create Identity Provider In Global Settings

{% stepper %}
{% step %}

### Create Identity Provider

Follow the general instructions in the article below to get started creating an OIDC Identity Provider.

1. [Adding an Identity Provider (SSO)](/global-settings/security/identity-providers-sso/adding-an-identity-provider-sso.md)
2. Complete the **Basic information** section.
   1. Select **OPEN\_ID** for the identity provider **Type**.
3. Complete the **Button information** section.
4. (Optional) Complete the **Group information** section.

#### **Complete OpenId Information Fields**

Copy the information from your AWS Cognito application into the OpenId Information section. The table explains which AWS Cognito values to enter into which Flosum Fields. The final screenshot shows a completed identity provider for an AWS Cognito OIDC application.

The values in the **AWS Cognito Value** column are a combination of values from your AWS Cognito app. Retrieving these values is explained in the sections above.

| Flosum Field      | AWS Cognito Value          |
| ----------------- | -------------------------- |
| **Client ID**     | **ISSUER\_CLIENT\_ID**     |
| **Client Secret** | **ISSUER\_CLIENT\_SECRET** |
| **Issuer**        | **ISSUER\_BASE\_URL**      |

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FIiZb0PKnqtRhaTNpVxjh%2FAwsCognitoOidcConfig-CreateIdentityProvider-01.png?alt=media&amp;token=c3e0cb85-2935-4e9d-9635-808839e7c364" alt="" width="563"><figcaption></figcaption></figure></div>

{% endstep %}

{% step %}

### Save and Test

{% hint style="info" %}
For instructions on logging in with SSO, see the following article.

* [Logging In With SSO](/global-settings/security/identity-providers-sso/logging-in-with-sso.md)
  {% endhint %}

1. Click **Save** to save the identity provider.
2. To test, open an incognito window.
3. Start logging in to Global Settings with your tenant name.
4. If the identity provider was configured successfully, you should see the SSO button you created.&#x20;

<div align="left"><figure><img src="https://579543750-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsEk2hU5IMh3HEY5dJZjR%2Fuploads%2FGvKim2Ukj224V8EpfFH4%2FAwsCognitoOidcConfig-CreateIdentityProvider-02.png?alt=media&amp;token=9acc8fbf-e76d-4915-b9e2-3e07a039de9b" alt="" width="375"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/global-settings/security/identity-providers-sso/oidc-identity-providers/aws-cognito-oidc-configuration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.