After deciding how you want to implement SSO, you are ready to set it up.

1. Send the SAML XML file that contains your SAML 2.0 federated metadata to the Pega Workforce Intelligence Service Delivery Team.
2. Create a relying party in your identity provider configuration, using the URN and Assertion Consumer URL provided by Workforce Intelligence.

   Value	Example
   URN	urn:amazon:cognito:sp:<user_pool_id>
   URL	URL: https://<domain-prefix>.auth.<region>.amazoncognito.com/saml2/idpresponse

Note: The process for creating a relying party is different depending on the identity provider that you use. For example, the link below is for Microsoft’s AD FS Management tool. Consult the documentation for your SAML identity provider to set up your relying party.

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust

3. Configure the relying party to provide the following SAML 2.0 Assertion claims:

   Assertion Claim	Example
   Persistent NameID	urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
   Email	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   First Name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   Last Name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

Note: These assertion claims are based on an AD FS environment. These claims are configured in AWS Cognito to identify the attributes Workforce Intelligence needs to extract from the SAML assertion. Claims may vary based on your identity provider.
4. Choose an identity provider display name (if SSO fails and the user is taken to the login page).
5. Ensure that the identity provider supports the following:
   • a SAML 2.0 Relay State
   • an HTTP-Redirect endpoint for SAML Requests
   • use of the POST binding for the SAML Response to the service provider
6. Ensure that the authorization endpoints domain is approved on the client network proxy. For example: https://<domain-prefix>.auth.<region>.amazoncognito.com.

• Implementing Single Sign-On