Can i Identity/differentiate when a user signs in via a SAML identity providers and social identity providers with cognito user pools Federated identity provider?

0

I'm implementing SSO for my app and I want only users that sign via SAML identity providers like azure to log into enterprise accounts to offer more security, while a user that signed in with a social identity provider or with username and password should not have access to enterprise accounts unless the account admin decides it is possible.

Can i Identity/differentiate when a user signs in via a SAML identity providers and social identity providers with cognito user pools Federated identity provider?

Is there any possible way to do this? Or any better alternative?

1 Answer
0

The answer is 'Yes'.

  • About Federation Under federation, your 3rd IdPs provide authentication while your cognito user pool acts as a bridge between multiple service providers and your app. To your IdP, Amazon Cognito is a service provider (SP).

  • About Authorization Your IdPs pass an OIDC ID token or a SAML assertion to Amazon Cognito. Amazon Cognito reads the claims about your user in the token or assertion and maps those claims to a new user profile in your user pool directory. Amazon Cognito then creates a user profile for your federated user in its own directory.

After Amazon Cognito creates a profile for your federated user, it changes its function and presents itself as the IdP to your app, which is now the SP. Amazon Cognito is a combination OIDC and OAuth 2.0 IdP. It generates access tokens, ID tokens, and refresh tokens.

Therefore, in order to avoid someone accessing to enterprise accounts, you'd try to control the Authorization in access tokens. Meanwhile, you can also use the user "group" of Cognito user pool. Users inherit group permissions, which are written to their access tokens, and "group" could be associate with an IAM role to get relative Authorization in AWS.

More details: [1] https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html?icmpid=docs_cognito_console_help_panel [2] https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-access-token.html [3] https://docs.aws.amazon.com/cognito/latest/developerguide/accessing-resources.html

AWS
answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions