COGNITO OIDC Signout of IDP -OKTA

user_273212 0
Viewed 377

Configured OKTA as OIDC Identity Provider in my cognito user pool. In Okta App Admin provided the below as Sign in URL https://.auth.ap-southeast-2.amazoncognito.com/oauth2/idpresponse

What do I provide the Signout Url in OKTA. Tried the below its not working https://.auth.ap-southeast-2.amazoncognito.com/Logout

Tried to signout from Cognito Hosted UI the below way but its not signing the user out of OKTA

https://<pooldomain name.auth.ap-southeast-2.amazoncognito.com/logout?client_id=xxxxxxxxxx&logout_uri=https://www.example.com/logout

okta amazon-cognito
2 Answers

This is a top result in Google, but there's no answer provided yet. I did some troubleshooting on my side, and when I used the Audience URI (SP Entity ID) value as the SP Issuer value, logouts work.

So in Okta,

  1. Select Applications.
  2. Select your application (the one you created and linked with Cognito. More details in the link below)
  3. Click General
  4. Under SAML Settings, click Edit
  5. On the general settings tab, click Next
  6. On the SAML Settings tab, click Show Advanced Settings
  7. Copy your value for Audience URI (SP Entity ID)
  8. Check the box for: Enable Single Logout
  9. For Single Logout URL, use: https://<YOUR_DOMAIN>.auth..amazoncognito.com/saml2/logout
  10. For SP Issuer, paste the value you copied from step #7
  11. For Signature Certificate, upload the Cognito cert for your pool.

https://aws.amazon.com/premiumsupport/knowledge-center/cognito-okta-saml-identity-provider/

user_147018120

You can find more details here

But what you you're interested in is:

https://server.com/.well-known/openid-configuration

There you should find end_session_endpoint

user_38291740
Related