Administrator or above

Set up single sign-on with Amazon Cognito

3 min read · Updated 6 Nov 2026

This guide covers the Amazon Cognito side of single sign-on: preparing your user pool and creating an app client for Astrato. It then hands back to the Astrato steps, which are the same for every provider.

Before you start

You meet the requirements in Set up single sign-on, and have read Do not lock yourself out.
You can manage the Cognito user pool your people sign in to, in the AWS console.
The user pool has a domain for its hosted sign-in pages. Astrato sends people to those pages.
The people who will sign in have an email address in the user pool. Astrato identifies people by email.

Values you will bring back to Astrato

Astrato Setup field	Where it comes from in Cognito
Issuer URL	`https://cognito-idp.<region>.amazonaws.com/<user-pool-id>`, for example `https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_Example1`
Scope	Optional. Leave it empty unless your app client needs extra scopes
Client ID	The app client’s ID
Client secret	The app client’s secret
Identity provider domains	The email domains your people sign in with, for example `example.com`

Copy the callback URLs from Astrato

In Astrato, open Administration → Enterprise Connection and stay on Login connections.
Select Add connection and choose Amazon Cognito in Select a Login provider.
Leave the Configuration tab open. It lists two callback URLs, the sign-out redirect URL and the scopes openid profile email.

Choose Amazon Cognito rather than Open ID Connect: Astrato signs people in through Cognito’s own login type for it.

Create the app client in Cognito

In your user pool, create an app client for Astrato with these settings. Cognito’s own guide is Application-specific settings with app clients.

It has a client secret. Astrato’s sign-in needs one, so choose the type of app client that generates it, such as a traditional web application.
Allowed callback URLs holds both callback URLs from Astrato’s Configuration tab.
Allowed sign-out URLs holds the sign-out redirect URL from the same tab.
The OAuth grant type is Authorization code grant.
The OpenID Connect scopes include openid, email and profile.

Then copy the app client’s Client ID and Client secret, and the user pool’s ID and region for the issuer URL.

Finish in Astrato

Go back to the Add connection dialog and select Continue to Setup. Fill in the values from the table above, then follow the rest of Set up the connection, Verify the connection and Test a normal sign-in.

The Add connection dialog with Amazon Cognito selected, on its Setup tab: Connection name, Issuer URL https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_Example, an optional Scope field outlined, Identity provider domains example.com, Client ID, a masked Client secret, the Allow users outside the identity provider domain to sign in without SSO box ticked, and Cancel and Create buttons

What you see	Likely cause	What to do
Cognito shows An error was encountered with the requested page.	The client ID is wrong, or a callback URL is missing from Allowed callback URLs	Check the client ID in Astrato, and add both callback URLs exactly as shown
Verification cannot reach the provider	The issuer has the wrong region or user pool ID	Open the issuer with `/.well-known/openid-configuration` added to check it
Cognito signs the user in, but Astrato does not	The user has no email address, or the app client does not allow the `email` scope	Add the email address, and allow the `openid`, `email` and `profile` scopes

For errors on the Astrato side, see Common errors.

What next

Test a normal sign-in before you clear Allow users outside the identity provider domain to sign in without SSO.
Sync groups and roles from your provider