<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);" class="elementToProof">We are trying to configure Shibboleth as an SP with AWS Cognito. The goal is to support customers who would like
to authorize internal users as well as external users to access a web-based application that has limited SSO support (but does support Shibboleth). Most of the time the external entities will originate in an Azure AD tenant, but we would like to be able to
support other IdPs in the future.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
The only documentation I have found thus far is this page that Scott put together: <a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito" class="MsgExtLink_86a4143a-d339-7f15-4703-0cdb88614761">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1429930512/AmazonCognito</a>.
Using that page as a guide I have been working on constructing the correct metadata. I was wondering if anyone might be able to suggest what I am doing wrong. Ultimately, I would like to help provide more details that could be used to update the above document
for anyone else who might want to employ the same setup.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);">Using the AmazonCognito page linked above as a guide for constructing the metadata file for the SP...</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
------------</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<i>"For some SAML identity providers, you also need to provide the SP Audience URI / SP Entity ID, in the form:</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0 ContentPasted1">
<div class="elementToProof"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);"><i>urn:amazon:cognito:sp:<yourUserPoolID>"</i></span></div>
<div class="elementToProof ContentPasted2"><br>
</div>
<div class="elementToProof ContentPasted2"><span style="background-color: rgb(255, 255, 255);">In the metadata xml, I have set the entitiyID accordingly (whether this is necessary or not, I don't know):</span><br>
</div>
<div class="elementToProof ContentPasted2"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo"><br class="ContentPasted2">
<br>
</div>
<div class="elementToProof ContentPasted2"><span class="ContentPasted0 ContentPasted1 ContentPasted10" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">------------</span><br class="Apple-interchange-newline ContentPasted10">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted3"><i>"You also need to provide an assertion consumer endpoint to your SAML identity provider. Configure this endpoint for SAML 2.0 POST binding in your SAML identity provider:</i></div>
<div class="elementToProof ContentPasted2 ContentPasted3">
<div class="elementToProof"><i style="font-family: inherit; font-size: inherit; font-variant-ligatures: inherit; font-variant-caps: inherit; font-weight: inherit; background-color: rgb(255, 255, 255);">https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/idpresponse"</i><br>
</div>
</div>
<div class="elementToProof ContentPasted2"><br>
</div>
<div class="elementToProof ContentPasted2"><span style="background-color: rgb(255, 255, 255);">Anytime there is a talk about the Assertion Consumer Endpoint/URL I get confused as to exactly what this is referring to. I guessed
</span><span class="ContentPasted9" style="display: inline !important; background-color: rgb(255, 255, 255);">(probably incorrectly) </span><span style="background-color: rgb(255, 255, 255);">that this is the URL for the SingleSignOnService</span><span style="background-color: rgb(255, 255, 255);">:</span><br>
</div>
<div class="elementToProof ContentPasted2"><br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4"><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/></div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted7"><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/><br class="ContentPasted7">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted7"><span class="ContentPasted0 ContentPasted1 ContentPasted11" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">------------</span><br class="Apple-interchange-newline ContentPasted11">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5"><i class="elementToProof">"Configure this endpoint for consuming logout responses from your IdP. This endpoint uses post binding.<br>
https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/saml2/logout"<br class="ContentPasted4">
</i><br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5">This seemed straight-forward enough:</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5"><br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6">
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/>
<div class="ContentPasted6 elementToProof"><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/></div>
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6">
<span class="ContentPasted0 ContentPasted1 ContentPasted12" style="font-size: 12pt; margin: 0px; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">------------</span><br class="Apple-interchange-newline ContentPasted12">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6">
Not sure of RelyingPartyConfiguration is needed.</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6 ContentPasted13">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6 ContentPasted13">
<br>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6 ContentPasted13">
This is the current metadata XML:</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6 ContentPasted13">
<br>
<div class="ContentPasted13 elementToProof"><?xml version="1.0" encoding="UTF-8"?></div>
<div class="ContentPasted13 elementToProof"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_lfCRX6MMo"></div>
<div class="ContentPasted13 elementToProof"> <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div>
<div class="ContentPasted13 elementToProof"> <md:KeyDescriptor use="signing"></div>
<div class="ContentPasted13 elementToProof"> <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"></div>
<div class="ContentPasted13 elementToProof"> <ds:X509Data></div>
<div class="ContentPasted13 elementToProof"><span style="background-color: rgb(255, 255, 255);"><span> </span><span> </span><ds:X509Certificate>...<span style="display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted14"></ds:X509Certificate></span></span></div>
<div class="ContentPasted13 elementToProof"> </ds:X509Data></div>
<div class="ContentPasted13"> </ds:KeyInfo></div>
<div class="ContentPasted13"> </md:KeyDescriptor></div>
<div class="ContentPasted13 elementToProof"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/></div>
<div class="ContentPasted13"> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/logout"/></div>
<div class="ContentPasted13 elementToProof"> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat></div>
<div class="ContentPasted13"> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/></div>
<div class="ContentPasted13"> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://nusol-p6.auth.us-west-2.amazoncognito.com/saml2/idpresponse"/></div>
<div class="ContentPasted13 elementToProof"> </md:IDPSSODescriptor></div>
<div class="ContentPasted13 elementToProof"></md:EntityDescriptor></div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6 ContentPasted13">
<br>
</div>
</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6">
Testing access to the application redirects to the SingleSignOnService Location URL and generates a useless error which I would dig into if I could find any logs on the AWS side. I strongly suspect my metadata is wrong. I have searched around in re:Post for
some help on the AWS side, but there are very few results related to Shibboleth (4 results total).</div>
<div class="elementToProof ContentPasted2 ContentPasted4 ContentPasted5 ContentPasted6">
<br>
</div>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);">As an aside,
<span style="display: inline !important; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="ContentPasted8">
we are using Rocky Linux 9. </span>I had been making decent headway with configuring a Shibboleth SP against AWS IAM Identity Center, but AWS support recommended we use Cognito given the use case outlined above (IAM IC can only federate with a single external
IdP).</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div class="elementToProof">
<div id="Signature">
<div>
<div></div>
<div></div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<b><span style="font-size: 12pt; color: rgb(31, 73, 125);">Regards,</span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<b><span style="font-size: 12pt; color: rgb(31, 73, 125);"><br>
</span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<b><span style="font-size: 12pt; color: rgb(31, 73, 125);"></span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<b><span style="font-size: 12pt; color: rgb(31, 73, 125);">Simon Cunningham</span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<b><span style="font-size: 12pt; color: rgb(31, 73, 125);">Software Engineer - Nu Solutions Consulting</span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span style="color: rgb(31, 73, 125);">Mobile: </span><span id="gc-number-83" class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);">+1.907.529.0775</span><br>
</p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);">Office: + 1.907.290.2848</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);"><br>
</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);"><img class="EmojiInsert" style="max-width:100%" data-outlook-trace="F:1|T:1" src="cid:a7b862a6-36d0-4f47-9657-251773a2c04d"><br>
</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);"></span></p>
<div class="MsoNormal" style="margin: 0px 0in 0.000133333px; font-size: 15px; font-family: Calibri, sans-serif; color: rgb(33, 33, 33); background-color: rgb(255, 255, 255);">
<span class="gc-cs-link" title="Call with Google Voice" style="text-decoration: underline; color: rgb(0, 51, 187);"><br>
</span></div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>