Profile picture

Mateusz Hołowieszko

AWS Cognito with Azure Active Directory as a Federated Identity Provider

August 02, 2021

Sign in through Azure Active Directory federated identity provider

AWS side:
  1. Create the Cognito user pool
  2. Add a user pool domain name
  3. Add user pool’s app client
Azure side:
  1. Select Tenant
  2. Go to the Azure Active Directory
  3. Go to the Enterprise applications
  4. New application
    • Create your own application
    • Select: “Integrate any other application you don’t find in the gallery (Non-gallery)”
    • Select: “Set up single sign on”
    • SAML
    • Basic SAML configuration 
      Identifier (Entity ID): urn:amazon:cognito:sp:<COGNITO_USER_POOL_ID>
Reply URL (Assertion Consumer Service URL): <user_pool_domain_name>

Image

  1. Copy “App Federation Metadata Url”
  2. Add users/groups to the app
AWS side:

Identity providers

  1. Go to the Identity providers
  2. SAML
  3. SAML configuration
Metadata document: <app_federation_metadata_url>
Provider name: AAD

Image

Attribute mapping

  1. Go to the Attribute mapping
  2. SAML, select “AAD” from the dropdown
  3. Add SAML attribute
Capture: true
SAML attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
User pool attribute: Email

Image

App clients settings

Image

Sign in via hosted UI. It should redirect you to the http://localhost:3000/?code=00000-00000-00000-00000.

x