- \n
- A 黑料海角91入口 administrator account<\/li>\n\n\n\n
- 黑料海角91入口 SSO Package or higher or SSO add-on feature<\/li>\n\n\n\n
- An administrator account in Amazon Cognito<\/li>\n\n\n\n
- Your User Pool ID, subdomain and region<\/li>\n\n\n\n
- Before you configure your identity pool to support a SAML provider, first configure the SAML IdP in the\u00a0IAM console<\/a>. For more information, see\u00a0Integrating third-party SAML solution providers with AWS<\/a>\u00a0in the\u00a0IAM User Guide<\/em><\/li>\n<\/ul>\n\n\n\n
Considerations<\/strong><\/p>\n\n\n\n
- \n
- This application only supports SP-initiated authentication<\/li>\n\n\n\n
- To define roles for Amazon Cognito, create 黑料海角91入口 User Groups for each role that needs access to Amazon Cognito. Then authorize these groups to access the application by following the steps in\u00a0Authorize User Access<\/a>. The groups and roles are sent to Amazon Cognito in the SAML assertion.\u00a0When a user from one of the authorized groups accesses Amazon Cognito, they gain access based on the role assigned to their group<\/li>\n<\/ul>\n\n\n\n
Creating a new 黑料海角91入口 Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the 黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure 黑料海角91入口<\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Replace any instances of YOUR_SUBDOMAIN, YOUR_REGION, and YOUR_USER_POOL_ID with your values.<\/li>\n\n\n\n
- Optionally, add a Default RelayState<\/strong> value.<\/li>\n\n\n\n
- In Login URL<\/strong>, enter the login URL needed for your users.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nSince this application only supports SP-initiated authentication, this is the URL users need to log in to Amazon Cognito User Pools.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Add any additional attributes.<\/li>\n\n\n\n
- Ensure include group attribute<\/strong> is enabled. <\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the 黑料海角91入口 metadata<\/strong> file<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- The 黑料海角91入口-<applicationname>-metadata.xml<\/strong> will be exported to your local Downloads <\/strong>folder.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Tip:<\/strong> \nMetadata can also be downloaded from the Configured Applications<\/strong> list. Search for and select the application in the list and then click Export Metadata<\/strong> in the top right corner of the window.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure Amazon Cognito<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the AWS Management Console as an administrator.<\/li>\n\n\n\n
- Go to Services<\/strong> > Security, Identity, & Compliance <\/strong>> Cognito<\/strong>.<\/li>\n\n\n\n
- Click Manage User Pools<\/strong>, then Create a user pool<\/strong>.<\/li>\n\n\n\n
- Enter a name for the Pool Name.<\/li>\n\n\n\n
- Click Review Defaults<\/strong>, then Create Pool<\/strong>.<\/li>\n\n\n\n
- On the left side, select Domain name<\/strong>.<\/li>\n\n\n\n
- Enter an available domain prefix, then save it.<\/li>\n\n\n\n
- On the left side, choose Identity provider<\/strong>.<\/li>\n\n\n\n
- Select SAML<\/strong>. <\/li>\n\n\n\n
- Upload the 黑料海角91入口 metadata file, name it, then click Create Provider<\/strong>.<\/li>\n\n\n\n
- Under Federation, select Attribute mapping<\/strong>.<\/li>\n\n\n\n
- Add the required email<\/kbd> attribute and any additional user attributes.\u00a0<\/li>\n\n\n\n
- Click Save changes<\/strong>. <\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to 黑料海角91入口, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Click Manage User Pools<\/strong>, then Create a user pool<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
- Select the SSO<\/strong> tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the 黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/important-icon.png\"){kind=icon}
<\/p><\/div>