Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

UserNotFoundException while calling Amazon Connect GetFederationToken()

0

I have set up SAML 2.0 authentication for my Amazon Connect instance in AWS to facilitate federated identity authentication. And I created an IAM instance, Role, identity provider, and Identity Center application pointing to the Connect instance. I am able to access it through the IAM access portal successfully.

Now, I have configured it to facilitate webUI authentication through Cognito hosted UI login pages. I have created a user pool, an identity pool, and created an external provider link in the app client, etc. I integrated it into my native iOS SwiftUI application using the Amplify SDK for Swift and AWS SDK for Swift. I am able to get the sign-in callback and thus able to fetch the AWS temporary credentials: AccessKeyId, SecretKey, SessionToken, etc.

I have created a user in the Amazon Connect with the login username field as the email ID used here in IAM Identity Center. However, when I try to call the GetFederationToken() API of the Amazon Connect service (not the STS one), I am getting a UserNotFoundException.

Now, I just noticed that the username in the user pool when the user first logs in through the hosted UI has the format <external-provider-name>_<username>. Might this be causing the issue since this is automatically created when user first authenticates through cognito? Or is Cognito not suitable for this?

Topics
Business ApplicationsSecurity, Identity, & Compliance
Tags
Amazon Cognito Federated IdentitiesAmazon ConnectAmazon CognitoAmazon Cognito User Pools
Language
English

asked a year ago235 views

1 Answer
0

The issue you're experiencing with the UserNotFoundException when calling the Amazon Connect GetFederationToken() API is likely related to a mismatch between the user identifiers in Amazon Connect and the federated identity from Cognito.

When using federated authentication with Amazon Connect, it's important to ensure that the user identifiers align across your identity provider, Cognito, and Amazon Connect. The fact that Cognito is automatically creating usernames in the format <external-provider-name>_<username> could indeed be causing this issue.

Amazon Connect expects to find a user that matches the federated identity. If the username in Amazon Connect doesn't match the identifier coming from Cognito, you'll encounter the UserNotFoundException.

To resolve this, you have a few options:

  1. Modify your Amazon Connect user creation process to match the Cognito username format. This means creating users in Amazon Connect with the <external-provider-name>_<username> format.

  2. Configure your Cognito User Pool to use a different attribute as the username, such as email. This can be done when setting up the User Pool by specifying email as an alias attribute.

  3. If possible, customize the federation process to pass the correct identifier to Amazon Connect that matches the username you've set up in the Connect instance.

  4. Review your SAML configuration to ensure that the correct user identifier is being passed through the federation process.

It's also worth noting that while Cognito can be used for federation with Amazon Connect, many implementations use IAM Identity Center (formerly AWS SSO) directly for this purpose, especially in enterprise scenarios. IAM Identity Center provides a more streamlined experience for SAML-based federation with Amazon Connect.

If you continue to face issues, you may want to review your entire authentication flow, ensuring that the user identifiers are consistent across all services involved in the federation process.
Sources
GetFederationToken - Amazon Connect
How to implement trusted identity propagation for applications protected by Amazon Cognito | AWS Security Blog
Amazon WorkSpaces Secure Browser FAQs – Amazon Web Services

answered a year ago

  • rePost-User-1992047
    a year ago

    I tried adding the cognito username format to amazon connect too, still no luck. I am again getting user not found error. What values does get cross matched when this GetFederationToken() is called?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content