We have created a SAML application which allows portal users to do SSO and log into an internal platforms. The way this is configured is as follows: 1) IAM Identity Center contains the users and groups. It also has a SAML application to allow for the login flow to work. 2) Cognito User Pool with Federated Identity Provider sign-in that points towards the IAM Identity sso portal (portal.sso.us-east-1.amazonaws.com) The authentication process works fine. However, it looks like the IAM Identity Center groups are not being properly synced into the Cognito User Pool. When you login -- a group is automatically created and all users are assigned to that single group. However their groups from IAM Identity Center are not auto synced. Is there a particular setting that needs to be enabled for this to work?

How do you sync IAM Identity Center groups to Cognito?

We have created a SAML application which allows portal users to do SSO and log into an internal platforms.

The way this is configured is as follows:

IAM Identity Center contains the users and groups. It also has a SAML application to allow for the login flow to work.
Cognito User Pool with Federated Identity Provider sign-in that points towards the IAM Identity sso portal (portal.sso.us-east-1.amazonaws.com)

The authentication process works fine. However, it looks like the IAM Identity Center groups are not being properly synced into the Cognito User Pool. When you login -- a group is automatically created and all users are assigned to that single group. However their groups from IAM Identity Center are not auto synced.

Is there a particular setting that needs to be enabled for this to work?

주제

보안, 신원 및 규정 준수

태그

AWS IAM 자격 증명 센터 아마존 코그니토 페더레이션 자격 증명 아마존 코그니토 사용자 풀 아마존 코그니토 싱크

언어

English

stodorov

질문됨 9달 전387회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

There is not way as such in SAML to “sync” groups.

What you have to do is in the attributes returned for the user is to include group membership. It then depends if cognito will then create these groups.

I don’t have an indent centre to test with but it’s usually how SAML works.

전문가

Gary Mclean

답변함 9달 전

stodorov
9달 전
I thought the same thing, but Cognito doesn't seem to have such an option to map the external groups. Also, in the Identity Center docs there are no roles attributes mentioned https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappingsconcept.html so I'm scratching my head how this should be done. Do you have any links to docs that might be helpful?

How do you sync IAM Identity Center groups to Cognito?

관련 콘텐츠