Amazon Cognito

Testiny can be configured to use Amazon Cognito as your identity provider for single sign-on (SSO). Testiny supports configuring both SSO and email login, or restricting logins by requiring SSO logins. This guide explains how to configure the Amazon Cognito integration using the OpenID Connect protocol.

Paid feature

Please note that single sign-on (SSO) will be available in a future coporate billing plan. Please contact us at [email protected] if you would like to have early access to this feature.

Configuring SSO

To configure SSO with Amazon Cognito, you first need to create a web app integration in Amazon Cognito and then configure Amazon Cognito as the SSO provider in Testiny.

Configuration in Amazon Cognito

If you've already created an OAuth client for Testiny in Amazon Cognito, then you can skip this section and continue configuring SSO in Testiny.

1. Go to the Amazon Cognito Console, open the side menu and choose user pools (1). Then (2), choose an existing user pool, or create a new one. In (3), notice the user pool ID that will be needed later to create the URL to the OpenID connect data. You can also check out the Amazon documentation on how to create an app integration.

2. Select the tab App Integration.

3. Scroll down and click Create app client to create a new app integration.

4. First, select the app type Confidential client (1) and define an app name, e.g. 'Testiny' in (2). In (3), generate a client secret should be automatically selected.

5. Scroll down further to "Hosted UI settings". In (1), add the following URL as an allowed callback URL:
   https://app.testiny.io/api/v1/oauth/redirect
   In (2), you can optionally add the following URL as an allowed sign-out URL:
   https://app.testiny.io/api/v1/oauth/logout
   The other settings can be left as they are.

6. Scroll down to the end of the page and click Create app client.

7. Now the app client has been created successfully and it should show up in the app client list as indicated in the screenshot below. Open the app by clicking on its name.

8. In this detail view, please note that you'll need the client ID (1) and client secret (2) in the next step when configuring SSO in Testiny.

Configuration in Testiny

To configure Amazon Cognito as your SSO provider, you need to have admin rights in Testiny. In Testiny, go to the settings and select Organization (1), as shown in the screenshot below. Click on 'Configure single sign-on' (2). A side panel (3) opens where you need to define the following options:

1. Provider — Choose 'Amazon Cognito' from the list.
2. OpenID Configuration — Specify the URL to the OpenID Connect metadata. In Amazon Cognito, the URL should look like the following example: https://cognito-idp.((region)).amazonaws.com/((userPoolId))/.well-known/openid-configuration
   In this template, replace region and user pool ID with the values from your Amazon Cognito account. You can find these values in the list of user pools as shown in step 1 in the section above on how to configure an app client in Amazon Cognito.
3. SSO Domains — Enter the domains that will be able to use single sign-on.
   3.1 If you have already invited users from these domains to your Testiny organization, an option will show up to change the login type of these users. By default, the users' login type will be set to "SSO allowed".
4. Client ID — Enter the client ID of the client created in Amazon Cognito. You can copy the ID from your app client as described above in the last step in the section on how to configure an app client in Amazon Cognito.
5. Client Secret — Enter the client secret of the client created in Amazon Cognito. You can copy the secret from your app client as described above in the last step in the section on how to configure an app client in Amazon Cognito.
6. Click on "Save". Once SSO is successfully configured, you can invite SSO users to your organization or update existing users to use SSO login in the user management settings.

To invite users to your organization, navigate to Settings > User management and click the "Invite" button in the top left corner. A side panel will appear, where you can choose whether the SSO login is allowed, required or disabled:

• allowed — the user can log in via SSO, but can also create a password in Testiny and use the email login
• required — the user must log in via SSO
• disabled — the user cannot log in via SSO, only with email login

Then, enter the email address of the user to be added and optionally the first and last name. In the "Role" drop-down, you can adjust the user’s permissions. Learn more about the user management in Testiny.

Logging into Testiny

When SSO is configured in your Testiny organization and the user is invited as an SSO user, they can simply log in to Testiny on the login page. When SSO is required, the user can only log in with SSO. If SSO is allowed but not required, the user might also log in via email and password.

note

Please note that the owner of the organization in Testiny cannot be restricted to require SSO login so that the owner can always log in with email & password.

Disabling SSO

To disable SSO, go to Settings > Organization and click the next to the configured provider. A dialog will be shown to see which users are affected and cannot log in via SSO anymore. After confirming, SSO is disabled and you continue using email/password login or set up a new SSO provider.

Changing your SSO provider

If you want to modify your SSO configuration or change to another SSO provider, simply click the "Configure sinlge sign-on" button to open the configuration side panel. You can change the SSO provider and set up a new SSO configuration, or add new SSO domains to your current configuration. If you remove an SSO domain, single sign-on may be deactivated for users in this SSO domain.