allowing multiple tenants Microsoft oidc in AWS Cognito

0

I am implementing a SAAS application to onboard users from Google, Microsoft.

I am trying to enable OIDC-based authentication using Microsoft accounts in AWS Cognito User Pools.

I have created an App in Microsoft Azure Entra ID, with a Multitenant category that allows any tenant from Microsoft or personal accounts.

I have added an Identity provider in the Cognito User pools, and then created a Client in the Application Integration section of the Cognito User pool that uses the newly created Microsoft identity provider.

The above configuration works well if I configure the issuer URL with my tenant id in the URL i.e., https://login.microsoftonline.com/b42efbab-8c3e-4632-a49f-86093cf0ba2c/v2.0

But ideally, this should have a common endpoint as the issuer could be any tenant. I.e., https://login.microsoftonline.com/common/v2.0

But if I change the issuer URL to the above common URL, The correct Microsoft flow starts. Still, I assume the check for issuer in Cognito fails because Microsoft always returns the specific tenant id inside the jwt token as part of the issuer and that results In bad issuer error.

Error: Bad+id_token+issuer+https%3A%2F%2Fsts.windows.net%2F231a9774-bca7-4379-88f3-8509c87cb5bb&error=invalid_request

Is there any way that AWS Cognito supports Multitenant Microsoft applications? Ideally, I would like to configure a built-in solution in the Cognito.

已提問 5 個月前檢視次數 142 次
沒有答案

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南