Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How to Ensure IdP Session Termination When AWS Cognito Cookie Expires in SAML SSO

0

※ Please note that this text was translated from Japanese to English, so some parts may be inaccurate.

[1. Purpose]

Ensure that in the SSO environment integrating AWS Cognito and a SAML IdP (Akamai Enterprise Application Access), the IdP session is reliably terminated even when the Cognito session cookie has expired, and that on subsequent access the IdP’s login page (prompting for username and password) is always shown.

[2. Background and current status]

  • This system uses Akamai Enterprise Application Access as the SAML IdP and integrates it with AWS Cognito to provide SSO.
  • The IdP metadata XML is registered in Cognito’s “Social providers and external providers metadata documents,” and Cognito is configured to call the IdP’s session-termination URL when ending a Cognito session so that the IdP session is also terminated.
  • Expected behavior:
    1. The user clicks the application’s “Logout” button.
    2. The application sends a logout request to Cognito.
    3. Cognito ends its session and invokes the IdP session-termination URL.
    4. The IdP session is terminated.
    5. On subsequent access, the IdP displays the login page and, after authentication, access is granted.
  • Current issue:
    • When logout is performed while the Cognito session cookie (expiration: 1 hour) is already expired, Cognito does not send the IdP session-termination URL.
    • As a result, the IdP session remains active and the IdP does not show the re-authentication page on subsequent access; the user is taken directly to a logged-in view.
  • Similar cases have been reported on AWS re:Post.

[3. Questions / Items to confirm]

  1. Is this behavior due to an AWS Cognito specification/limitation, or is it caused by a configuration issue?
  2. Is there a way to ensure the IdP session is terminated even when the Cognito session cookie has expired?
  3. Please provide all other possible mitigation strategies.

[4. Where the problem occurs]

Logout processing in an environment that integrates a SAML IdP (Akamai Enterprise Application Access) with AWS Cognito Hosted UI.

[ AWS documentation URLs referenced and relevant sections]

Topics
Security, Identity, & Compliance
Tags
Amazon CognitoAmazon Cognito User Pools
Language
English

asked 10 months ago299 views

1 Answer
0

Understanding SAML Single Sign-Out with Amazon Cognito

When using Amazon Cognito with a SAML identity provider (IdP) like Akamai Enterprise Application Access, the behavior you're experiencing is related to how SAML single sign-out (SLO) works with Cognito.

Current Behavior Analysis

The issue you're experiencing occurs because:

  1. When a user's Cognito session cookie expires (after 1 hour in your case), Cognito no longer has context about the user's SAML session.
  2. Without an active Cognito session, when a logout is attempted, Cognito cannot properly direct the SAML logout request to your IdP's SLO endpoint.

How SAML Single Sign-Out Works in Cognito

When a user with an active SAML session is directed to the Cognito /logout endpoint, Cognito sends a signed SAML logout request to the IdP's Single Logout Service endpoint specified in the IdP metadata. The IdP then processes this request, terminates the session, and sends a LogoutResponse back to Cognito's saml2/logout endpoint.

For this flow to work properly, Cognito needs to know:

  • The user has an active SAML session
  • Which IdP to send the logout request to
  • The session information to include in the logout request

Mitigation Strategies

  1. Direct IdP Logout: Instead of relying solely on Cognito's /logout endpoint, implement a direct logout to both systems. When a user clicks logout, your application can:
  • Call Cognito's logout endpoint
  • Also directly call your IdP's logout endpoint

  1. Shorter Session Duration: Align the session timeout values between Cognito and your IdP to minimize the window where one system has an active session while the other doesn't.

  2. Client-Side Session Management: Implement client-side tracking of session status. When detecting a Cognito session expiration, proactively redirect the user to the IdP logout endpoint.

  3. Custom Logout Flow: Implement a custom logout flow where your application first checks if the Cognito session is active:

  • If active, use the standard Cognito logout flow
  • If expired, directly redirect to the IdP's logout endpoint
  1. Application Load Balancer Integration: If you're using an Application Load Balancer (ALB), ensure your application sets the expiry to -1 for all authentication cookies during logout and redirects to the IdP logout endpoint.

The most reliable approach would be a combination of strategies 1 and 4, where your application handles both the Cognito logout and direct IdP logout, with logic to determine which path to take based on the Cognito session status.
Sources
Signing out SAML users with single sign-out - Amazon Cognito
The managed login sign-out endpoint: /logout - Amazon Cognito
Authenticate users using an Application Load Balancer - Elastic Load Balancing
Identity provider and relying party endpoints - Amazon Cognito

answered 10 months ago

  • sm
    10 months ago

    The following countermeasures have all been considered and found to be infeasible:

    1. Direct IdP Logout: It is not possible to send a direct logout request from Cognito to Akamai because the logout information for Akamai held by Cognito cannot be obtained. Therefore, the 1st, 3rd, 4th, and 5th solutions proposed in the Mitigation Strategies are infeasible.

    2. Shorter Session Duration: The session duration for Cognito is 1 hour, and for Akamai it is 2 hours, and neither can be changed. The 2nd solution proposed in the Mitigation Strategies is infeasible.

    Given these constraints, could you please advise if there are any other effective countermeasures?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content