Questions about Shibboleth and AWS Cognito

Sun Apr 16 06:06:19 UTC 2023

Simon, 

I’m not exactly sure what your doing but I’ve never seen AWS Cognito metadata as an IDP fragment so start by removing that. 
Here is a MD fragment from one of our POC Cognito apps… 

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID=":urn:amazon:cognito:sp:us-west-2_WwM6naijS">
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://testbca.auth.us-west-2.amazoncognito.com/saml2/idpresponse" index="1"/>
<Extensions>
<mdui:UIInfo xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<mdui:DisplayName xml:lang="en”>BCA-COGNITO-POC</mdui:DisplayName>
</mdui:UIInfo>
</Extensions>
</md:SPSSODescriptor>
</md:EntityDescriptor>

HTH 

--------
thanks
 kevin.foote

> On Apr 13, 2023, at 1:44 PM, Simon Cunningham <simon at nu-solutions.com> wrote:
> 
> [External Email - Use caution]
> 
> We are trying to configure Shibboleth as an SP with AWS Cognito. The goal is to support customers who would like to authorize internal users as well as external users to access a web-based application that has limited SSO support (but does support Shibboleth). Most of the time the external entities will originate in an Azure AD tenant, but we would like to be able to support other IdPs in the future.
> 
> The only documentation I have found thus far is this page that Scott put together: https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito. Using that page as a guide I have been working on constructing the correct metadata. I was wondering if anyone might be able to suggest what I am doing wrong. Ultimately, I would like to help provide more details that could be used to update the above document for anyone else who might want to employ the same setup.
> 
> 
> Using the AmazonCognito page linked above as a guide for constructing the metadata file for the SP...
> 
> ------------
> 
> "For some SAML identity providers, you also need to provide the SP Audience URI / SP Entity ID, in the form:
> urn:amazon:cognito:sp:<yourUserPoolID>"
> 
> In the metadata xml, I have set the entitiyID accordingly (whether this is necessary or not, I don't know):
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">
> 
> ------------
> 
> "You also need to provide an assertion consumer endpoint to your SAML identity provider. Configure this endpoint for SAML 2.0 POST binding in your SAML identity provider:
> https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/idpresponse"
> 
> Anytime there is a talk about the Assertion Consumer Endpoint/URL I get confused as to exactly what this is referring to. I guessed (probably incorrectly) that this is the URL for the SingleSignOnService:
> 
> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
> 
> ------------
> 
> "Configure this endpoint for consuming logout responses from your IdP. This endpoint uses post binding.
> https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/logout"
> 
> This seemed straight-forward enough:
> 
> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
> 
> ------------
> 
> Not sure of RelyingPartyConfiguration is needed.
> 
> 
> This is the current metadata XML:
> 
> <?xml version="1.0" encoding="UTF-8"?>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">
>     <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>         <md:KeyDescriptor use="signing">
>             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>                 <ds:X509Data>
>           <ds:X509Certificate>...</ds:X509Certificate>
>                 </ds:X509Data>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
>         <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
>         <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
>         <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
>         <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
>     </md:IDPSSODescriptor>
> </md:EntityDescriptor>
> 
> Testing access to the application redirects to the SingleSignOnService Location URL and generates a useless error which I would dig into if I could find any logs on the AWS side. I strongly suspect my metadata is wrong. I have searched around in re:Post for some help on the AWS side, but there are very few results related to Shibboleth (4 results total).
> 
> As an aside, we are using Rocky Linux 9. I had been making decent headway with configuring a Shibboleth SP against AWS IAM Identity Center, but AWS support recommended we use Cognito given the use case outlined above (IAM IC can only federate with a single external IdP).
> 
> Regards,
> 
> Simon Cunningham
> Software Engineer - Nu Solutions Consulting
> Mobile: +1.907.529.0775
> Office:  + 1.907.290.2848
> 
> <Outlook-05qxp23g.jpg>
> 
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net