View a markdown version of this page

Set up enterprise sign-in with Okta for Amazon Quick on desktop - Amazon Quick
Step 1: Create an OIDC application in OktaStep 2: Add the desktop connector with your identity provider configurationStep 3: Download, verify, and distribute the desktop application
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Set up enterprise sign-in with Okta for Amazon Quick on desktop

 Applies to: Enterprise Edition 
   Intended audience: System administrators 

Use these steps only if you choose Configure Identity Provider when you add the desktop connector. Most organizations don't need a separate identity provider configuration for the desktop application. For the default setup, see Turning on desktop access.

This page walks you through the three steps to set up enterprise sign-in with Okta:

  1. Create an OpenID Connect (OIDC) application in Okta and record its values.

  2. Add the desktop connector with your identity provider configuration.

  3. Download, verify, and distribute the desktop application.

Before you begin, review the prerequisites in Setting up Amazon Quick on desktop for enterprise deployments and Using a dedicated identity provider configuration (advanced).

Note

To sign in, users need an active Amazon Quick web session in their browser. The email address in Okta must exactly match the user's email address in Quick, and Okta must not mark that email address as unverified. For more information, see How sign-in works with a dedicated identity provider.

Step 1: Create an OIDC application in Okta

Register an OIDC native application in Okta. The Amazon Quick desktop application uses this client to authenticate users through the authorization code flow with PKCE, and requests the openid, profile, email, and offline_access scopes at sign-in.

For more information, see Create OpenID Connect app integrations in the Okta documentation.

To create the Okta OIDC Native Application

  1. In the Okta Admin Console, navigate to Applications → Applications → Create App Integration.

  2. Select OIDC - OpenID Connect as the sign-in method.

  3. Select Native Application as the application type, then choose Next.

  4. Configure the following settings:

    Setting Value
    App integration name Amazon Quick Desktop
    Grant type Authorization Code and Refresh Token
    Sign-in redirect URIs http://localhost:18080
    Assignments Assign to the appropriate users or groups

  5. Choose Save.

  6. On the General tab, note the Client ID.

Okta enforces PKCE (S256) automatically for native applications.

To verify authentication settings

  1. In the app integration, go to the General tab.

  2. Under General Settings, confirm that the application type is Native, client authentication is None (public client), and PKCE is Required.

  3. Under LOGIN, confirm that http://localhost:18080 is listed as a redirect URI.

  4. Choose Save if you made any changes.

Record the following OIDC endpoints. You enter these values, together with the Client ID you noted earlier, in Step 2. Replace <OKTA_DOMAIN> with your Okta domain (for example, your-org.okta.com). For the endpoint reference, see Authorization Code with PKCE in the Okta documentation.

Field Value
Client ID The Client ID from the General tab
Issuer URL https://<OKTA_DOMAIN>
Authorization endpoint https://<OKTA_DOMAIN>/oauth2/v1/authorize
Token endpoint https://<OKTA_DOMAIN>/oauth2/v1/token
JWKS URI https://<OKTA_DOMAIN>/oauth2/v1/keys
Use the standard Okta domain, not the admin subdomain

Use your standard Okta domain (for example, your-org.okta.com) in these endpoints, not the -admin subdomain (your-org-admin.okta.com) shown in the address bar of the admin console. The -admin subdomain does not host the OAuth endpoints, so using it causes sign-in to fail with an HTTP 404 error.

Step 2: Add the desktop connector with your identity provider configuration

In the Amazon Quick console, add the desktop connector and enter the values that you recorded in Step 1.

Important

Adding the desktop connector turns on desktop access for all users in your account right away. To roll out desktop in stages, restrict the Quick desktop capability in a custom permissions profile before you add the connector. For more information, see Turning on desktop access. You can also restrict the capability after you add the connector.

To add the desktop connector

  1. Sign in to the Amazon Quick console as an administrator.

  2. Choose your profile icon, and then choose Manage account.

  3. In the navigation pane, choose Inbound connectors, and then choose the Quick Desktop tab.

  4. Choose Add desktop connector.

  5. For the identity setup, choose Configure Identity Provider, and then enter the values that you recorded in Step 1:

    Identity provider configuration values
    Field Value
    Issuer URL The exact OIDC issuer URL from Step 1, including any required path suffix.
    Authorization endpoint The OIDC authorization endpoint URL from Step 1.
    Token endpoint The OIDC token endpoint URL from Step 1.
    JWKS URI The JSON Web Key Set URI from Step 1.
    Client ID The OIDC client identifier (Client ID or Application (client) ID) that you recorded in Step 1.

  6. Choose Confirm.

  7. Verify that the connector card shows the name Quick Desktop and the status Enabled.

Note

Adding the desktop connector is a one-time, account-level action. After the connector is enabled, all users in your account can sign in with your identity provider. Users don't need to turn anything on themselves.

Step 3: Download, verify, and distribute the desktop application

In this step, you install the desktop application, verify that enterprise sign-in works, and then distribute the application to your users.

First, download and install the application. For download locations and installation steps, see Downloading and installing.

Then, verify that enterprise sign-in works.

To verify enterprise sign-in

  1. Open the Amazon Quick desktop application.

  2. On the sign-in screen, choose Continue with SSO.

  3. (Optional) Select your Amazon Web Services Region, or choose Dynamic to detect your Region automatically.

  4. Sign in with your corporate credentials. The application redirects to your identity provider, and then opens the Home screen after sign-in succeeds.

Tip

If sign-in fails, check the values that you entered in Step 2 against the values from Step 1. For more information, see Troubleshooting enterprise sign-in for Amazon Quick on desktop.

Finally, distribute the application to your users. Direct them to Getting started with the Amazon Quick desktop application for download, installation, and sign-in instructions. Users choose Continue with SSO and sign in with their corporate credentials. They don't need any other setup.