How do I set up Okta as a SAML identity provider?

Dazychain uses Secure Assertion Markup Language (SAML) as our single sign-on (SSO) authentication method via Amazon Cognito. Cognito user pools allow sign-in through a third party (federation), including through an IdP, such as Okta. 

A user pool integrated with Okta allows users in your Okta app to get user pool tokens from Amazon Cognito. 

Create a SAML app in Okta

1. Open the Okta Developer Console. 
2. In the top left corner, pause on Developer Console, and then choose Classic UI. This opens the Admin Console. 
   Important: You must be in the Admin Console (Classic UI) to create a SAML app.
3. Under Shortcuts, choose Add Applications.
4. On the Add Application page, choose Create New App.
5. In the Create a New Application Integration dialog, confirm that Platform is set to Web.
6. For Sign on method, choose SAML 2.0.
7. Choose Create.

Configure SAML integration for your Okta app

1. On the Create SAML Integration page, under General Settings, enter a name for your app.
2. (Optional) Upload a logo and choose the visibility settings for your app.
3. Choose Next.
4. Under GENERAL, for Single sign on URL, enter https://yourDomainPrefix.auth.region.amazoncognito.com/saml2/idpresponse.
   Note: Replace yourDomainPrefix and region with the values for your user pool. Dazychain will have provided you with the URL required.
5. For Audience URI (SP Entity ID), enter urn:amazon:cognito:sp:yourUserPoolId.
   Note: Replace yourUserPoolId with your Amazon Cognito user pool ID. You can find this value in the Amazon Cognito console on the General settings page for your user pool.
6. Under ATTRIBUTE STATEMENTS (OPTIONAL), add a statement with the following information:
   For Name, enter the SAML attribute name http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
   For Value, enter user.email.
7. Add additional fields user.givenname and enter SAML attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname 
8. Add additional fields user.surname and enter SAML attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
9. For all other settings on the page, leave them as their default values or set them according to your preferences.
10. Choose Next.
11. Choose Finish.

Assign a user to your Okta application

1. On the Assignments tab for your Okta app, for Assign, choose Assign to People.
2. Choose Assign next to the user that you want to assign.
   Note: If this is a new account, the only option available is to choose yourself (the admin) as the user.
3. For User Name, enter a user name, or leave it as the user's email address, if you want.
4. Choose Save and Go Back. Your user is assigned.
5. Choose Done.

Get the IdP metadata for your Okta application

On the Sign On tab for your Okta app, find the Identity Provider metadata hyperlink. Right-click the hyperlink, and then copy the URL.

For more information, see Specify your integration settings in the Build a Single Sign-On (SSO) Integration guide on the Okta Developer website.

Configure Okta as a SAML IdP

1. Provide the Identity Provider metadata URL that you copied to Dazychain