Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Cognito auth via ALB returns 401 but then succeeds on retry

0

I have enabled Cognito auth on my ALB. I log in via my dns entry sample.my-domain.com I'm using a SAML IDP in Cognito (Google workspace) and it takes me through he auth flow and I sign in via my google account but I'm presented with a 401 Authorization Required. If I then enter the exact same url sample.my-domain.com, I am successfully taken to my site. I can see the access token in my headers and the correct cookies set by the ALB. I can then browse the site correctly, leave, come back and everything works. If I log out and back in, I get the same initial 401, So it only happens at login, after that everything is fine. I enabled logging on the ALB and I'm getting an AuthInvalidStateParam error on the first call. I can see that call is is GET https://sample.my-domain.com:443/oauth2/idpresponse?code=<REDACTED>&state=<REDACTED>

When I'm pretend the 401 page I see a AWSALBAuthNonce cookie, but no load balancer cookie. When I enter the site url again, I see the AWSALBAuthNonce and the ALB cookies.

Thanks for the help

Topics
Security, Identity, & Compliance
Tags
Application Load BalancerAmazon Cognito
Language
English

asked 2 years ago682 views

2 Answers
0

So, upon further investigation, we had both Google Social login as well as our own SAML corporate Google Workspace enabled in Cognito. I've been trying this with with the SAML Google Workspace. For debugging purposes, I removed Google Social login from the app client. The error seems to have gone away.

So is something getting confused bc I have both Google Social and Google SAML IDPs enabled on my Cognito app client? In theory I feel like there may be scenarios where we'd want both enabled.

answered 2 years ago

0

Well, to further confuse me, I added the google social back in and it still worked. The difference was originally I had google social, our google saml and a few other IDP SAMLs.... when I removed the other IDP SAMLs (and left just google social and google saml) it works. This is quite strange. The Cognito Hosted UI is different when it has >1 SAML provider. Could there be a bug there?

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content