Trouble Configuring AD App

Question

Trouble Configuring AD App

Shane 1

Hi,

We are trying to set up AD as a SAML Provider to our Cognito Pool which is a common use case. It seems we have been able to get the correct XML file as AD is accurately identifying the app name but we keep running into issues with our Reply URL.

I have read similar questions and I think our Reply URL configured on the Admin AD side matches Cognito.

Here is the troubleshooting details:
Request Id: 6ee9aca4-bdd4-42ce-9c2d-cb16037c0b00
Correlation Id: 97764005-8d6b-48b0-ac41-e0a08939fcaf
Timestamp: 2021-12-07T01:31:04Z
Message: AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'urn:amazon:cognito:sp:us-west-2_XXXXXXXX'. (Do not want to expose the User Pool ID but it is accurate).

I think you should be able to tell that our Redirect URL matches the one in our request.

Thanks ahead for any guidance!

Siva-kumar-selvaraj 15,721 Reputation points

2022-01-04T06:47:44.44+00:00

@Shane ,
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

2 answers

Your answer

Siva-kumar-selvaraj 15,721 Reputation points

2022-01-04T06:47:44.44+00:00

@Shane ,
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Thanks for reaching out.

I noticed that the reply URL mentioned in the application does not match the url specified in the request (it should be /saml2/idpresponse). Please see the screenshot below for your reference.

To fix the issue, update your application with url that is specified in the request. I hope this was helpful.

Alternative text for above image:

Reply url specified in the request is https://*****-bp.****.us-****-2.amazoncognito.com/saml2/idpresponse
Reply url specified in the Application is https://*****-bp.****.us-****-2.amazoncognito.com/saml2/idresponse

------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Shane 1

Thanks for getting back to me. That is an interesting finding... can you see if you get a similar Reply URL specified in this error?

Request Id: 804e0ff6-9345-4a6f-85cc-282dcfee1c00
Correlation Id: 9f7d6d2a-7c1b-4bb4-b213-827904b07d9c
Timestamp: 2021-12-07T07:19:16Z
Message: AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: 'urn:amazon:cognito:sp:us-west-2_XXXXXXX'.

I can say for sure that the reply url listed in that error does not include "idpresponse." I find it strange that happened as Cognito errors out when we put a callback url that it is not expecting and I am fairly certain I did not "https://*****-bp.****.us-****-2.amazoncognito.com/saml2/idpresponse" in there as well.

If that error comes back with the "idpresponse" problem again there must be something strange going on.

Thanks again

Siva-kumar-selvaraj 15,721 Reputation points

2021-12-07T09:22:28.043+00:00

@Shane ,

Yes, I still see the same reply url in the authentication request https://*****amazoncognito.com/saml2/idpresponse (asterisks are masked to avoid exposure) sent by the AWS Cognito application. As a result, you must update the same url in your Azure AD application to resolve this issue.

May I ask how you verified that the request does not include "*****amazoncognito.com/saml2/idpresponse"? I'm curious as to whether you decoded the SAML request to see what was in the 'AssertionConsumerServiceURL' value in the SAML request and verified that it matched the Reply URL value specified in Azure AD.

To decode SAML request, you could use "Test this application" feature from Azure AD as shown below:

To learn more about, refer: https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/error-code-aadsts50011-reply-url-mismatch
Siva-kumar-selvaraj 15,721 Reputation points

2021-12-09T06:12:29.837+00:00

@Shane , Just checking in to see whether the response was helpful. If this solves your question, please don't forget to click "Accept the answer" and Up-Vote for it, which may be useful to other members of the community reading this topic. Please let us know if you have any further questions.
Thanks,

Share via

Trouble Configuring AD App

2 answers

Your answer