View a markdown version of this page

Configure any external identity provider - Spatial Data Management on AWS
Configure OIDC federationConfigure SAML federationEnable the identity provider for the app clientVerify the integrationTroubleshooting

Configure any external identity provider

This page describes the protocol-level configuration that applies to any OpenID Connect (OIDC) or SAML 2.0 identity provider, along with the steps to enable, verify, and troubleshoot federation. For a detailed walkthrough of a specific provider, see Configure Microsoft Entra ID.

Before you begin, complete the prerequisites and gather your Amazon Cognito values described in Single sign-on (SSO). The procedures below use the placeholders defined in Placeholders used in these procedures.

Configure OIDC federation

At a high level, configuring OIDC federation requires you to:

  1. Register an application (relying party) in your identity provider, using the OIDC redirect endpoint from Gather your Amazon Cognito values as the redirect (callback) URI.

  2. Obtain a client ID, a client secret, and the issuer URL from your identity provider.

  3. Register your identity provider as an OIDC identity provider in the Amazon Cognito user pool, and map identity provider claims to user pool attributes.

  4. Enable the identity provider for the portal app client (see Enable the identity provider for the app client).

To create the OIDC identity provider in Amazon Cognito:

  1. In the Amazon Cognito console, choose User pools, and then select your user pool.

  2. Choose Sign-in experience > Federated identity provider sign-in.

  3. Choose Add identity provider, and then choose OpenID Connect (OIDC).

  4. Configure the following:

    • Provider name – A name for the provider. This name appears on the sign-in button.

    • Client ID – The client ID issued by your identity provider.

    • Client secret – The client secret issued by your identity provider.

    • Authorized scopes – Enter openid email profile (space-separated), or the scopes your provider requires.

    • Issuer URL – The OIDC issuer URL for your identity provider. Amazon Cognito discovers the authorization, token, and JSON Web Key Set (JWKS) endpoints from the issuer’s /.well-known/openid-configuration document.

  5. Under Map attributes between your OpenID Connect provider and your user pool, map the provider claims to user pool attributes. At a minimum, map email. Typical mappings are:

    User pool attribute OIDC claim

    email

    email

    given_name

    given_name

    family_name

    family_name

    username

    sub

  6. Choose Add identity provider.

Then enable the identity provider as described in Enable the identity provider for the app client.

Configure SAML federation

At a high level, configuring SAML 2.0 federation requires you to:

  1. Create a SAML application in your identity provider, and provide it with the Amazon Cognito service provider (SP) values from Gather your Amazon Cognito values (the ACS URL and the SP entity ID / audience URI).

  2. Configure the SAML attributes (claims) that the identity provider sends, and (optionally) a groups claim.

  3. Obtain the identity provider metadata (a metadata URL or an XML file).

  4. Register your identity provider as a SAML identity provider in the Amazon Cognito user pool, and map SAML attributes to user pool attributes.

  5. Enable the identity provider for the portal app client (see Enable the identity provider for the app client).

To create the SAML identity provider in Amazon Cognito:

  1. In the Amazon Cognito console, choose User pools, and then select your user pool.

  2. Choose Sign-in experience > Federated identity provider sign-in.

  3. Choose Add identity provider, and then choose SAML.

  4. Configure the following:

    • Provider name – A name for the provider. This name appears on the sign-in button.

    • Identifiers (optional) – Leave blank unless your provider requires an identifier.

    • Add sign-out flow – Select this option to enable single logout, if your provider supports it.

    • Metadata document source – Choose Metadata document URL and paste your provider’s federation metadata URL, or choose Upload metadata document and upload the metadata XML file.

  5. Choose Add identity provider.

  6. Locate the Attribute mapping section, choose Edit, and map the SAML attributes sent by your provider to user pool attributes. At a minimum, map email.

  7. Choose Save changes.

Then enable the identity provider as described in Enable the identity provider for the app client.

Enable the identity provider for the app client

After you create the OIDC or SAML identity provider, enable it for the portal app client so that it appears on the sign-in page.

  1. In the Amazon Cognito console, select your user pool.

  2. Choose App clients, and then select the portal app client (the name follows the pattern spatial-data-portal-client).

  3. Choose the Login pages tab, and then choose Edit.

  4. Under Identity providers, select and enable the identity provider you created.

    Note

    To require federation-only sign-in, clear Cognito user pool so that users can sign in only through the external identity provider. Leave it selected if you want to continue to allow direct Cognito user pool sign-in.

  5. Choose Save changes.

Verify the integration

  1. In your identity provider, make sure a test user is assigned to the SDMA application.

  2. Open the Spatial Data Portal sign-in page, or the Cognito hosted UI.

  3. Confirm that the Sign in with <Provider name> button appears.

  4. Choose the button and complete authentication with your corporate credentials.

  5. Confirm that you are redirected back to SDMA and signed in, and that user attributes (email, given name, family name) are populated.

Note

Newly federated users start with no permissions in SDMA. An administrator in the SpatialDataManagementAdministrators group must assign a permission level before they can work with resources. For more information, see Access Management.

Troubleshooting

The sign-in button does not appear
redirect_mismatch or redirect_uri error after sign-in

  • Verify that the redirect URI in your identity provider exactly matches your Cognito domain, including /oauth2/idpresponse (OIDC) or /saml2/idpresponse (SAML).

  • Confirm the Cognito domain value under Branding > Domain.

User authenticates but is not signed in to SDMA

  • Verify the attribute mappings between the identity provider and the user pool. At a minimum, email must be mapped.

  • For SAML, confirm that the SAML attribute claim names match the values in the Attribute mapping section.

Group permissions do not take effect

  • Confirm that the groups claim is configured in your identity provider.

  • Confirm that the group name in your identity provider matches the Cognito group used for access assignment. For more information, see Access Management.

  • Recent group changes can take a few minutes to propagate. Sign out and sign back in to refresh tokens.