- Newest
- Most votes
- Most comments
To my knowledge, AWS Cognito does not currently expose a configuration option to change the NameID format in its SAML AuthnRequest - it always requests persistent. However, the critical requirement isn't the format declaration itself; it's that the NameID value remains consistent across sessions. If your IdP can be configured to return a stable identifier (like a user GUID or email) as the NameID value, Cognito will accept it even if the format declared in the assertion isn't strictly "persistent." Alternatively, you might configure your IdP to ignore the requested NameIDPolicy format entirely. If neither is possible, consider using an OIDC connection instead or placing a SAML proxy between Cognito and your IdP.
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp-things-to-know.html "The attribute that you set to NameID in your IdP configuration must have a persistent value. If NameID changes, Amazon Cognito considers the assertion to be for a new user."
I think it is not natively supported but you might be able to achieve it using Lambda triggers and SAML attributes. You can find details on how to achieve it here - https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-inbound-federation.html
Relevant content
asked 2 years ago
asked 8 months ago
asked 2 years ago
Thanks Shajam. Problem is that, trigger only fires after a successful assertion, and we never get that far.. the IdP (Shibboleth) returns InvalidNameIDPolicy with no assertion at all, so the Lambda never gets invoked.
The actual blocker is the NameID format: Cognito's AuthnRequest sends Format=persistent (AllowCreate=false), but the IdP only issues transient, so it rejects the request before releasing anything.
Is there any way to change the NameID format Cognito requests in its AuthnRequest (to transient or unspecified)? Or any supported option when the IdP can't produce persistent? That seems to be the real issue here.