Unable to configure SSO with AWS for multitenant signin

Question

Hi,

I am trying to setup a registered app to accept multi tenant signin with single sign on.
I am trying to use cognito with it, which needs the identity URI to be of the format "urn:amazon:cognito:sp:<your-cognito-user-pool-id>", but I am not able to add this value in the SAML configuration nor as part of the identity URIs in the manifest section.

Any tips of what I can do here?

Answer 1

Hi @Ishika Shah,

Based on your query, here is my understanding: You would like to configure multi-tenant sign in for your AWS application.

Entra supports multi-tenant sign in using OAuth or OpenID connect for the applications registered from app registrations. While configuring this application, you will have an option to choose the supported account types for the application.

If you would like to configure IdentifierURI for this application, here are the supported formats: identifierUris attribute.

If you would like to have a SAML application for single sign on, you need to add identifier (Entity ID) in the specified format itself. You need to ensure the identifier and replyURL has been received from Amazon itself. You can add multiple instances that regards to the same entity. I have tried the format your provided (urn:amazon:cognito:sp:<your-cognito-user-pool-id>) where I am able to add without any issue. Please make sure you add the URLs provided from Amazon correctly. These URLs has to be identified in Amazon and configured accordingly.

I believe you may need to follow this document: How to set up SAML federation in Amazon Cognito using IdP-initiated single sign-on, request signing, and encrypted assertions.

Additional documentation: Using SAML identity providers with a user pool

Note: The above documents are from Amazon and Microsoft does not hold any responsibility. We have shared this information to make things easy for the configuration.