Questions about Shibboleth and AWS Cognito

Sun Apr 16 15:08:31 UTC 2023

Hello Simon,

I don't have any experience with AWS Cognito metadata, but have some
recommendations based on the article
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito
.

SInce you are configuring AWS Cognito as an SP, you need to use
"SPSSODescriptor", not "IDPSSODescriptor".  Also, "WantAuthnRequestsSigned"
is for IdPs, not SPs.

Regarding the "assertion consumer endpoint": replace
"md:SingleSignOnService" with "md:AssertionConsumerService".

The article says that both the assertion consumer endpoint (service) and
the endpoint for consuming logout responses use "post" bindings
("urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST").  Try removing the
HTTP-Redirect endpoint definitions.

And now we have to get into the weeds a bit about encryption and NameIDs.
The article says the service behavior "relies on signed responses and no
encryption", and it also says that they require a NameID.

There are different ways of turning off encryption.  You can set
"idp.encryption.optional = true" in idp.properties.  If you want to do it
on a per-service basis, the example relying-party.xml override in the
article is one way to do it.  I got the impression that you aren't very
familiar with relying party overrides, though.

I am a big fan of using metadata-driven configuration instead.  Your IdP
may already be set up to support metadata-driven configuration.  If not,
the tweaks are simple: see
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration#General-Configuration.
Once configured, there are simple stanzas to add to disable encryption for
the service: see
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration#%5BinlineExtension%5DDisabling-Encryption.
For the general approach of including these tags in metadata files, see
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631679/MetadataDrivenConfiguration#Applying-Tags
.

I think you need to use a different NameIDFormat other than
"urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified".   The article
intentionally doesn't give much guidance as to which format to use,
assuming you know about NameIDFormats and can choose which one is best for
your circumstance.  If you aren't familiar with NameIDFormats, I interpret
the article as saying you _can_ use
"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", with caveats, but
you _can't_ use "urn:oasis:names:tc:SAML:2.0:nameid-format:transient".  My
personal experience is that when I mess up and make a mismatch between
NameIDFormat and nameIDFormatPrecedence, no NameID will be sent.  That
could definitely end up with some odd Cognito error message during login.

Good luck!  -Les

<http://www.carleton.edu/>

*Les LaCroix '79*

Strategic Technologist

Information Technology Services

t: (507) 222-5455

On Thu, Apr 13, 2023 at 2:44 PM Simon Cunningham <simon at nu-solutions.com>
wrote:

> We are trying to configure Shibboleth as an SP with AWS Cognito. The goal
> is to support customers who would like to authorize internal users as well
> as external users to access a web-based application that has limited SSO
> support (but does support Shibboleth). Most of the time the external
> entities will originate in an Azure AD tenant, but we would like to be able
> to support other IdPs in the future.
>
> The only documentation I have found thus far is this page that Scott put
> together:
> https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito.
> Using that page as a guide I have been working on constructing the correct
> metadata. I was wondering if anyone might be able to suggest what I am
> doing wrong. Ultimately, I would like to help provide more details that
> could be used to update the above document for anyone else who might want
> to employ the same setup.
>
>
> Using the AmazonCognito page linked above as a guide for constructing the
> metadata file for the SP...
>
> ------------
>
> *"For some SAML identity providers, you also need to provide the SP
> Audience URI / SP Entity ID, in the form:*
> *urn:amazon:cognito:sp:<yourUserPoolID>"*
>
> In the metadata xml, I have set the entitiyID accordingly (whether this is
> necessary or not, I don't know):
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">
>
> ------------
>
> *"You also need to provide an assertion consumer endpoint to your SAML
> identity provider. Configure this endpoint for SAML 2.0 POST binding in
> your SAML identity provider:*
> *https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/idpresponse
> <http://amazoncognito.com/saml2/idpresponse>"*
>
> Anytime there is a talk about the Assertion Consumer Endpoint/URL I get
> confused as to exactly what this is referring to. I guessed (probably
> incorrectly) that this is the URL for the SingleSignOnService:
>
> <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
> <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
>
> ------------
>
>
>
> *"Configure this endpoint for consuming logout responses from your IdP.
> This endpoint uses post binding.
> https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/logout
> <http://amazoncognito.com/saml2/logout>" *
> This seemed straight-forward enough:
>
> <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
> <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
>
> ------------
>
> Not sure of RelyingPartyConfiguration is needed.
>
>
> This is the current metadata XML:
>
> <?xml version="1.0" encoding="UTF-8"?>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
> entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo">
>     <md:IDPSSODescriptor WantAuthnRequestsSigned="false"
> protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>         <md:KeyDescriptor use="signing">
>             <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>                 <ds:X509Data>
> <ds:X509Certificate>...</ds:X509Certificate>
>                 </ds:X509Data>
>             </ds:KeyInfo>
>         </md:KeyDescriptor>
>         <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
>         <md:SingleLogoutService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
>
> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
>         <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
>         <md:SingleSignOnService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
> https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/>
>     </md:IDPSSODescriptor>
> </md:EntityDescriptor>
>
> Testing access to the application redirects to the SingleSignOnService
> Location URL and generates a useless error which I would dig into if I
> could find any logs on the AWS side. I strongly suspect my metadata is
> wrong. I have searched around in re:Post for some help on the AWS side, but
> there are very few results related to Shibboleth (4 results total).
>
> As an aside, we are using Rocky Linux 9. I had been making decent headway
> with configuring a Shibboleth SP against AWS IAM Identity Center, but AWS
> support recommended we use Cognito given the use case outlined above (IAM
> IC can only federate with a single external IdP).
>
> *Regards,*
>
>
> *Simon Cunningham*
>
> *Software Engineer - Nu Solutions Consulting*
>
> Mobile: +1.907.529.0775
>
> Office:  + 1.907.290.2848
>
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230416/0d1f3391/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-05qxp23g.jpg
Type: image/jpeg
Size: 7446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20230416/0d1f3391/attachment.jpg>