AWS Cognito - OIDC - Configuration

Required User Credentials

[Flosum User] - SystemAdministrator Role

Important Note

The instructions in this article cover a third-party app and may not reflect the latest version. Please use these instructions as a guide to complete the task, but be aware that some screens, field names, and steps may have changed.

Overview

This guide explains how to integrate AWS Cognito using OpenID Connect (OIDC) with Flosum Cloud Apps to enable Single Sign-On (SSO) for seamless login.

For more general instructions about adding an Identity Provider, see the following article.

• Adding an Identity Provider (SSO)

Customer-Hosted

Customers who host Flosum Apps on their own infrastructure will have a custom URL for logging into their apps. When using this documentation, replace any Flosum Hosted URLs with your own URLs.

Outline Of Steps Involved

• Create a User Pool with AWS Cognito

• Determin Issuer URL

• Obtain the Client ID and Client Secret

• Set up the Redirect URL

• Create an Identity Provider with Flosum Global Settings

• Test the SSO

Configuring AWS Cognito for Flosum Cloud Apps

This section shows you how to configure an AWS Cognito User Pool to work with Flosum Cloud Apps for SSO.

Please note that the instructions for AWS Cognito may not reflect the latest version. Some screens, field names, and steps might have changed.

1

Create AWS Cognito User Pool

1. Access the AWS Management Console and navigate to the Cognito service.

2. Select Manage User Pools.

3. In the User Pools section, click the Create a User Pool button. You'll be prompted to name your new pool.

4. After naming your pool, select Step through settings. This section lets you define sign-in parameters for your users.

5. Select the attributes shown in the screenshot below. These attributes determine the information you'll collect from users during registration.

   
6. After setting the required attributes, click Next Step to save your configurations.

2

Setting Up Policies

1. Select the settings to match your security requirements.

2. Click Next Step.

   

3

MFA and Verification Configuration

1. Select Multi-Factor Authentication and verification settings based on your security needs.

2. Click Next Step to save your configurations.

   

4

Message Customizations

1. Edit the verification messages to meet your needs.

2. Click Next Step to save your configurations.

   

5

App Clients Configuration

1. Skip the Tags and Devices steps.

2. Configure the App Clients.

3. Click Add an app client.

4. Edit the settings to match the screenshot below.

5. Click Next Step to save your configurations.

   

6

Finalize the User Pool

1. On the Review step, verify all configurations are correct.

2. If everything is correct, click Create Pool to finalize the user pool creation.

7

Set the Domain Name

The next step is to create a Domain Name for the User Pool you created.

1. Navigate to the Domain Name tab.

2. Enter your desired Domain Prefix.

3. Click Check Availability.

4. If the domain is available, click Save Changes.

   

8

Configure App Client Settings

1. Navigate to App client settings and update them to match the configurations shown in the screenshot below.

   
2. In the CallBack URL(s) field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

United States URLs

Flosum Cloud App	Callback URL
Global Settings	https://global-us.flosum.app/api/v1/oauth/callback
Backup & Archive	https://backup-us.flosum.app/api/v1/oauth/callback
DevOps	https://devops-us.flosum.app/api/v1/oauth/callback

Germany URLs

Japan URLs

Austraila URLs

1. In the Sign-out URL(s) field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

United States URLs

Flosum Cloud App	Sign-Out URL
Global Settings	https://global-us.flosum.app/api/v1/oauth/login
Backup & Archive	https://backup-us.flosum.app/api/v1/oauth/login
DevOps	https://devops-us.flosum.app/api/v1/oauth/login

Germany URLs

Japan URLs

Austraila URLs

9

Retrieve the ISSUER_BASE_URL

You will need the ISSUER_BASE_URL value when creating the Identity Provider in Flosum Global Settings.

1. Navigate to Manage User Pools within AWS Cognito.

2. Select the User Pool you created, and then access General Settings.

3. Note the ISSUER_BASE_URL, which follows the format: https://cognito-idp.<region>.amazonaws.com/<userPoolId>.

   

10

Retrieve ISSUER_CLIENT_ID and ISSUER_CLIENT_SECRET

You will need the ISSUER_CLIENT_ID and ISSUER_CLIENT_SECRET values when creating the Identity Provider in Flosum Global Settings.

1. Navigate to Manage User Pools within AWS Cognito.

2. Select the User Pool you created, and then click on App Clients.

3. Note the ISSUER_CLIENT_ID, found under App client id.

4. Note the ISSUER_CLIENT_SECRET, found under App client secret.

11

Set Redirect URL

1. In the Redirect URL field, add the URL of your region for each Flosum Cloud App you want to use with SSO. See the table below for the URLs for your region.

United States URLs

Flosum Cloud App	Callback URL
Global Settings	https://global-us.flosum.app/api/v1/auth/login/open-id
Backup & Archive	https://backup-us.flosum.app/api/v1/auth/login/open-id
DevOps	https://devops-us.flosum.app/api/v1/auth/login/open-id

Germany URLs

Japan URLs

Austraila URLs

Create Identity Provider In Global Settings

1

Create Identity Provider

Follow the general instructions in the article below to get started creating an OIDC Identity Provider.

1. Adding an Identity Provider (SSO)

2. Complete the Basic information section.

   1. Select OPEN_ID for the identity provider Type.

3. Complete the Button information section.

4. (Optional) Complete the Group information section.

Complete OpenId Information Fields

Copy the information from your AWS Cognito application into the OpenId Information section. The table explains which AWS Cognito values to enter into which Flosum Fields. The final screenshot shows a completed identity provider for an AWS Cognito ODIC application.

The values in the AWS Cognito Value column are a combination of values from your AWS Cognito app. Retrieving these values is explained in the sections above.

Flosum Field	AWS Cognito Value
Client ID	ISSUER_CLIENT_ID
Client Secret	ISSUER_CLIENT_SECRET
Issuer	ISSUER_BASE_URL

2

Save and Test

For instructions on logging in with SSO, see the following article.

• Logging In With SSO

1. Click Save to save the identity provider.

2. To test, open an incognito window.

3. Start logging in to Global Settings with your tenant name.

4. If the identity provider was configured successfully, you should see the SSO button you created.