allowing multiple tenants Microsoft oidc in AWS Cognito

0

I am implementing a SAAS application to onboard users from Google, Microsoft.

I am trying to enable OIDC-based authentication using Microsoft accounts in AWS Cognito User Pools.

I have created an App in Microsoft Azure Entra ID, with a Multitenant category that allows any tenant from Microsoft or personal accounts.

I have added an Identity provider in the Cognito User pools, and then created a Client in the Application Integration section of the Cognito User pool that uses the newly created Microsoft identity provider.

The above configuration works well if I configure the issuer URL with my tenant id in the URL i.e., https://login.microsoftonline.com/b42efbab-8c3e-4632-a49f-86093cf0ba2c/v2.0

But ideally, this should have a common endpoint as the issuer could be any tenant. I.e., https://login.microsoftonline.com/common/v2.0

But if I change the issuer URL to the above common URL, The correct Microsoft flow starts. Still, I assume the check for issuer in Cognito fails because Microsoft always returns the specific tenant id inside the jwt token as part of the issuer and that results In bad issuer error.

Error: Bad+id_token+issuer+https%3A%2F%2Fsts.windows.net%2F231a9774-bca7-4379-88f3-8509c87cb5bb&error=invalid_request

Is there any way that AWS Cognito supports Multitenant Microsoft applications? Ideally, I would like to configure a built-in solution in the Cognito.

답변 없음

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인