Questions about Shibboleth and AWS Cognito

[Simon Cunningham]

We are trying to configure Shibboleth as an SP with AWS Cognito. The goal is to support customers who would like to authorize internal users as well as external users to access a web-based application that has limited SSO support (but does support Shibboleth). Most of the time the external entities will originate in an Azure AD tenant, but we would like to be able to support other IdPs in the future.

The only documentation I have found thus far is this page that Scott put together: https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito. Using that page as a guide I have been working on constructing the correct metadata. I was wondering if anyone might be able to suggest what I am doing wrong. Ultimately, I would like to help provide more details that could be used to update the above document for anyone else who might want to employ the same setup.


Using the AmazonCognito page linked above as a guide for constructing the metadata file for the SP...

------------

"For some SAML identity providers, you also need to provide the SP Audience URI / SP Entity ID, in the form:
urn:amazon:cognito:sp:<yourUserPoolID>"

In the metadata xml, I have set the entitiyID accordingly (whether this is necessary or not, I don't know):
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">

------------

"You also need to provide an assertion consumer endpoint to your SAML identity provider. Configure this endpoint for SAML 2.0 POST binding in your SAML identity provider:
https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/idpresponse"

Anytime there is a talk about the Assertion Consumer Endpoint/URL I get confused as to exactly what this is referring to. I guessed (probably incorrectly) that this is the URL for the SingleSignOnService:

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>

------------

"Configure this endpoint for consuming logout responses from your IdP. This endpoint uses post binding.
https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/logout"

This seemed straight-forward enough:

<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>

------------

Not sure of RelyingPartyConfiguration is needed.


This is the current metadata XML:

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">
    <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
        <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
    </md:IDPSSODescriptor>
</md:EntityDescriptor>

Testing access to the application redirects to the SingleSignOnService Location URL and generates a useless error which I would dig into if I could find any logs on the AWS side. I strongly suspect my metadata is wrong. I have searched around in re:Post for some help on the AWS side, but there are very few results related to Shibboleth (4 results total).

As an aside, we are using Rocky Linux 9. I had been making decent headway with configuring a Shibboleth SP against AWS IAM Identity Center, but AWS support recommended we use Cognito given the use case outlined above (IAM IC can only federate with a single external IdP).

Regards,

Simon Cunningham
Software Engineer - Nu Solutions Consulting
Mobile: +1.907.529.0775
Office:  + 1.907.290.2848

[cid:a7b862a6-36d0-4f47-9657-251773a2c04d]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230413/b36d75ee/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-05qxp23g.jpg
Type: image/jpeg
Size: 7446 bytes
Desc: Outlook-05qxp23g.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20230413/b36d75ee/attachment.jpg>