Single Sign-On with CTM
Initially, Michael Shanks created the Active Directory application in Azure for us. I found Active directory to be completely empty, so I had to make some initial adjustments for the two environments (production and staging). If you need access to the application settings, please feel free to reach out to him and ask him for ownership permission.
Important Links
Production Setting Links
Enterprise application management:
https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/SignOn/objectId/6c5f8303-a03b-4855-8822-fbd1d8e8367f /appId/8ab9e10b-e6c9-42f4-996b-ddd9d0d5def8/menuItemId/Overview Note: Under the “overview” you’ll have to select “Single sign-on” to see SSO configurations.
App Federation URL:
https://login.microsoftonline.com/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/federationmetadata/2007-06/federationmetadata.xml? appid=8ab9e10b-e6c9-42f4-996b-ddd9d0d5def8
Login Url:
https://login.microsoftonline.com/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/saml2
Azure AD Identifier:
https://sts.windows.net/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/
Staging Setting Links
Enterprise application management:
https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Overview/appId/85f11cae-9763-4338-a494-e1d4a8beea0e /objectId/d9d0e209-4d36-4cae-bd70-99112879e228 Note: Under the “overview” you’ll have to select “Single sign-on” to see SSO configurations.
App Federation URL:
https://login.microsoftonline.com/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/federationmetadata/2007-06/federationmetadata.xml? appid=85f11cae-9763-4338-a494-e1d4a8beea0e
Login Url:
https://login.microsoftonline.com/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/saml2
Azure AD Identifier:
https://sts.windows.net/5c5e19f6-a6ab-4b45-b1d0-be4608a9a67f/
Other Resourceful Links
IDP Authentication - AWS/SAML-specific: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp-authentication.html
https://d1.awsstatic.com/whitepapers/architecture/AWS_Well-Architected_Framework.pdf
https://docs.amplify.aws/lib/auth/getting-started/q/platform/js/
Set up in AWS
Whenever inside of Cognito, you can go to the Identity providers section where you will see the SAML option enabled. Within the SAML settings, you will see the metadata URL that links Cognito to AzureAD. You may be able to edit the existing active provider as shown below as ctm-azure-ad by clicking in the pencil icon. That simply configures Cognito to reach out to CTM's AzureAD's user base.
Within azure AD you would simply provide AWS's federation link.
We need to have at least two things:
The identifier (Entity ID)
The Reply URL (Assertion Consumer Service URL)
The Identifier (Entity ID) To begin with, we must must copy the Cognito Pool ID, and paste it in this format:
urn:amazon:cognito:sp:
For production, the identifier looks like this:
urn:amazon:cognito:sp:us-east-1_Zc3pNWX51
The Reply URL The reply URL comes in this format:
https://.auth..amazoncognito.com/saml2/idresponse
In our case, it looks like this for production:
https://atd-moped-production.auth.us-east-1.amazoncognito.com/saml2/idresponse
Once you save the settings, it looks like this in production:
This should be enough to get started, AWS is linked to AzureAD and AzureAD is linked to Cognito.
Testing your settings
At first you may use cognito's UI, no need to implement javascript. To do so, you need these specific links:
Using your own links for production, you can use these links:
For access-token login:
https://<COGNITO URL>/login?response_type=token&client_id=&redirect_uri=
For a code-based login (preferred):
https://<COGNITO URL>/login?response_type=code&client_id=&redirect_uri=
Production example access token login:
The last two links only show the patterns, to make use of them you can try this:
https://atd-moped-production.auth.us-east-1.amazoncognito.com/login?response_type=token&client_id=ins01e2a8d3vd8apvnd0jv10c&redirect_uri=https://mobility.austin.gov/moped/session/signin
Production example code login (preferred):
https://atd-moped-production.auth.us-east-1.amazoncognito.com/login?response_type=code&client_id=ins01e2a8d3vd8apvnd0jv10c&redirect_uri=https://mobility.austin.gov/moped/session/signin
For staging:
https://atd-moped-staging.auth.us-east-1.amazoncognito.com/login?response_type=token&client_id=3u9n9373e37v603tbp25gs5fdc&redirect_uri=https://moped.austinmobility.io/moped/session/signin
https://atd-moped-staging.auth.us-east-1.amazoncognito.com/login?response_type=code&client_id=3u9n9373e37v603tbp25gs5fdc&redirect_uri=https://moped.austinmobility.io/moped/session/signin
Redirect URI Warning
For SSO, the redirect URI needs to be listed in the allowed urls list in cognito (App client page).
Final Notes
This should cover the general overview on how to set up SSO with SAML in AWS Cognito. For additional instructions on how exactly the JavaScript internals work, visit the code base and AWS Amplify documentation:
https://docs.amplify.aws/lib/auth/getting-started/q/platform/js/
Last updated
