I’m currently working on integrating an application using Cognito with external IdPs (ADFS) using SAML. I have done the following steps for my user pool
1)I have created a SAML identity provider by importing the metadata of my ADFS server and enabled the signout flow checkbox.
2)Added the relying party trusts in the ADFS server for my userpool. Configured the singin end point as https://.auth..amazoncognito.com/saml2/idpresponse and logout endpoint as https://.auth..amazoncognito.com/saml2/logout.
3)Imported signing certificate from cognito to the relying party trust signature section.
When I am logging in it is asking for username and password of my Active directory. But During logout the request is going to /saml/logout endpoint and I am getting a successful response. Cognito cookie is getting cleared from the browser. But my ADFS cookies still remains in the browser. Next time When I am logging it my ADFS credentials are getting picked up from the browser. Cognito signout flow is unable to clear the federated IDP's cookies even when sign out flow is enabled. How can I fix this?
although this is not an answer for your question I would like to know how you managed to authenticate users using SAML Idp?
I've setup SAML Idp and enable it in my app client.
I am trying to log in using and android app that has 2 text fields for username and password and a login button.
I get UserNotFoundException. I followed Amazon documentation and cannot find a way to get over it. I'm confused.
Funny thing is that everything works flawlessly when I log in using the auto generated UI by Cognito that is accesses using below format.
Cognito Auto Generated UI
Related
I’m using AWS Cognito as User pool (for login) <> Auth0 as SAML-IDP (idp-initiated flow) (as Cognito does not support SAML IDP) <> and connecting to 3rd party SP.
I have a web-app which has login mechanism with AWS Cognito, and I’m trying to redirect logged-in customers to third-party URL (=SP, which requires log-in as well, SAML).
I have setup Auth0 to perform the SAML SSO, as Cognito does not support it and added OpenID Connect for authentication, to sync my existing users with Auth0 (AWS Cognito - see image below), which seems to work well (users are synced from my user-pool with Auth0/User Management/Users).
When i’m redirecting my logged in users, I redirect them to Auth0 Identity Provider Login URL (i.e: dev-APP.us.auth0.com/samlp/SOME_APP?connection=AWSCognito)
the problem i’m facing is that for the first time - user is required to log-in again (to cognito) although he was already logged in (see image below).
I was trying to follow up the requests made after redirection to Auth0 Provider Login URL and it seems that /authorize URL on cognito is the issue (https://XXXXX.auth.us-east-1.amazoncognito.com/oauth2/authorize)
Redirecting directly to AWS Cognito Domain with this URL won't work as well (to Hosted UI rather than to Auth0 URL): https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/login?response_type=token&client_id=<yourClientId>&redirect_uri=<redirectUrl> where the redirectURI is URLEncoded
Is there any way to skip that second login (first in my web-app and second is the Cognito hosted UI)?
thanks!
When trying to login via my AWS Cognito's login page via Azure AD with email#live.com credentials, I'm being redirected to https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-xxx-xxx-xxx-xxxx... and the page is throwing a 404 error.
Steps:
Created an Azure AD Enterprise Non Gallery Application.
Added identifier to enterprise application: urn:amazon:cognito:sp:ap-southeast-1_xxxxx
Added reply url as: https://xxxxx.auth.ap-southeast-1.amazoncognito.com/saml2/idpresponse
Downloaded the SAML Signing Certificate > Federation Metadata XML and uploaded it on Cognito by adding a new SAML identity provider.
Mapped SAML attribute http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress to Email under Cognito Attribute Mapping.
Enabled the AzureAd identity provider under App Client Settings on Cognito.
Allowed OAuth Flows: Authorization code grant, Implicit grant.
Invited an existing xxx#live.com user to Azure Active Directory and assigned a role to the user in the newly created Enterprise application.
Validated SSO from Enterprise Application > SSO > Validate. It's working as correctly, without any errors.
Problem:
When trying to login via Cognito's login url: https://xxxxx.auth.ap-southeast-1.amazoncognito.com/login?response_type=token&client_id=Cognito-App-Client-ID&redirect_uri=Callback-url-specified-in-cognito-app-client-settings --> AzureAd, I'm being redirected to https://login.microsoftonline.com/... where I enter the added user's email Id: xxx#live.com, after clicking next, instead of a password prompt the page throws a 404 error.
Also tried with inviting another user with email: xxx#mydomain.com, this also results in the same 404 error.
Tried in different browsers: chrome, firefox, safari. All result in the exact same error.
Azure AD SSO SAML2.0 integration doesn't work well with personal accounts.
Integrating with OIDC on the other hand works really well.
Azure AD integration with AWS Cognito.
I searched all over, tutorials, web, everybody jumps away without explaining(I understand why) the checkboxes in app client settings:
Enable sign-in API for server-based authentication
Only allow Custom Authentication
Enable username-password (non-SRP) flow for app-based authentication
The learn more link does not help me, lots of information and not so easy to understand, grasp. Can someone explain this settings?
Here is my take on the matter.
App client has several Auth Flow Configurations.
1. Enable username password auth for admin APIs for authentication (ALLOW_ADMIN_USER_PASSWORD_AUTH)
This enables Server-Side Authentication Flow. If you don't have an end-user app, but instead you're using a secure back end or server-side app.
2. Enable lambda trigger-based custom authentication (ALLOW_CUSTOM_AUTH)
This enables the Custom Authentication Flow. This can help you create a challenge/response-based authentication model using AWS Lambda triggers.
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html
Under User Pools -> Triggers you can see many lambda functions. You can use Create Auth Challenge, Define Auth Challenge and Verify Auth Challenge Response functions to create a custom authentication flow.
3. Enable username password based authentication (ALLOW_USER_PASSWORD_AUTH)
This enables Client Side Authentication Flow that uses user password-based authentication. In this flow, Cognito receives the password in the request.
You can use AWS Mobile SDK for Android, AWS Mobile SDK for iOS, or AWS SDK for JavaScript to implement this.
4. Enable SRP (secure remote password) protocol based authentication (ALLOW_USER_SRP_AUTH)
This is similar to the above flow in section 3. except for the password verification. This flow uses the SRP protocol to verify passwords.
http://srp.stanford.edu/whatisit.html
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolClientType.html
5. Enable refresh token based authentication (ALLOW_REFRESH_TOKEN_AUTH)
After successful authentication, Amazon Cognito returns user pool tokens(Three tokens) to your app. You can use the tokens to grant your users access to your own server-side resources, or to the Amazon API Gateway. Or, you can exchange them for temporary AWS credentials to access other AWS services.
The three tokens are ID Token(JWT), Access Token, Refresh Token. The refresh token can be used to retrieve new ID and access tokens. Once you login to a mobile app, you are not needed to log in each time when you close and open the application and this functionality is implemented using refresh tokens.
https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html
What about Amazon Cognito hosted UI ?
App clients can be configured to use built-in Cognito webpages for signing up and signing in users. When using the hosted UI you can enable both the Authorization code grant and the Implicit code grant, and then use each grant as needed.
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-idp-settings.html
Here is my attempt at explaining these options. Before that I would like to briefly mention about Oauth2, which is the protocol on which AWS Cognito is based.
In the context of AWS Cognito, Cognito itself is the Authentication (OAuth) server and also the Resource server (because we create users in Cognito user pool) and your app would be the Client (which sends the authentication request). The client has to first register itself with the OAuth server - this is what is being done in the "App clients" section of Cognito.
The recommended OAuth2 flow is Authorization Code Grant flow. In this flow,
i) The Client sends username/password to the OAuth Server.
ii) The OAuth server validates and calls back the client with a
authorization code.
iii) The Client again sends this code back to the OAuth server
iv) The OAuth server sends the tokens to the Client.
Please read the above linked article for more explanation on OAuth2.
Now explaining the options in Cognito App Client settings:
1. Enable sign-in API for server-based authentication
With this option, your client app can directly receive the tokens without having the additional step of first getting the authorization code.
There are Cognito APIs like AdminInitiateAuth, Admin-* which does this. However, these APIs require AWS admin credentials. Hence usually these calls are done by the backend server of the client app. The front-end can pass the username/password to the backend and the backend server can communicate with AWS Cognito and authorize the user.
2. Only allow Custom Authentication
Here you don't use the OAuth provided authorization code grant flow. Instead, you can define your own steps and challenges. Your client app can ask a secret question etc, before authenticating and giving tokens.
3. Enable username-password (non-SRP) flow for app-based authentication
This is the least safe flow. This skips the part of returning the authorization code and directly returns the tokens back to the client.
I hope this explains.
I'm not getting a clear picture of the authentication process when a user logs in through another idp. My use case being for an app that does not need aws credentials.
If I get a token back after a user logs in from facebook for example, how do I connect that with a user in the userpool or my own database which may contain the user's app specific data?
user logs into facebook -> gets token back -> send token to amazon cognito (?) -> get back cognito token (?)
I'm currently looking for documentation on how to implement the above but there doesn't seem to be a direct link to it.
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html
You could setup a social IdP such as Facebook and use the authorize endpoint.
Alternatively, Cognito now supports hosted signup and login pages for your application. You just need to create a Cognito domain, and set App Client Settings.
I am attempting to allow a third party app (Google Home) to access information from a AWS Cognito User Pool.
The flow of the entire process is as follows (assuming I understand it correctly that is):
The user tries to link their devices (which are all managed inside various AWS services) to Google Home.
The user is then redirected to our oauth2 page where they log into their account in the cognito user pool
They succesfully log in and are provided with an oauth token
The Google Home app can then use that token to send requests to our back end, allowing them to control their devices, but not the devices belonging to other users.
I am not exactly sure how to setup the cognito user pool as an oauth2 provider. I can find lots of info going the other way (for instance using Google to sign into our AWS user pool using federated identities) but that doesn't solve our problem.
Any help or direction would be greatly appreciated.
Thanks in advance
Amazon Cognito now supports OAuth 2.0. Login to the Amazon Cognito Console and follow these steps for an existing user pool:
Create a domain in the "App Integration" section.
In the same navigation go to "App Client Settings" and enable the providers you want enabled on the client, in your case Cognito. Also add the allowed callback and logout URIs as well as the allowed OAuth flows and scopes.
Now your authorize endpoint is https://.auth..amazoncognito.com/authorize?client_id=&redirect_uri=&response_type= and same way you can find the token endpoint.
More details...