Cognito SAML with multiple external IdPs

Question

A customer is trying to host a third party application and allow external customers (businesses ) access to it.  They need to have SAML integration with each of the businesses that purchase access to this tool.  The end goal is that the business buys access, integrates with the tool via SAML, and then there are no extra IDs to manage.

I think this is just configuring a provider in IAM for each of these businesses, and then adding them to a Cognito Identity Pool, but I haven't found an example to confirm.

Asking for confirmation of approach, examples if possible, and description of how it will pick the correct provider given multiple user bases ( email address? ).

Thanks!

Alex_P · Accepted Answer

You can use Amazon Cognito User Pools [federation][1] by adding a sign-in through a [SAML IdP][2] (among others). Just to note that this is different from Amazon Cognito Identity Pools (Federated Identities) flow. [Building ADFS Federation for your Web App using Amazon Cognito User Pools][3] blog post provides end-to-end walk through.

As for SAML IdP identifier to automatically redirect the user to relevant IdP and UI customization, see [Choosing SAML Identity Provider Names][4] in the documentation.

[1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html
  [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html
  [3]: https://aws.amazon.com/blogs/mobile/building-adfs-federation-for-your-web-app-using-amazon-cognito-user-pools/
  [4]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html

Dalibor · Answer

Is this Federated connection creation possible using just SDK ? we want do it dynamically from our App.... Can you point me on SDK API for this ?

Cognito SAML with multiple external IdPs

Relevant content