Cognito + Microsoft Entra ID SSO

[pueblas]

I've been trying to setup Cognito for user management, and Entra ID as IdP within Cognito. AFAIK there's no documentation regarding this matter, nevertheless the docs state that Cognito can be used for user management . I followed Cognito's docs on how to configure an IdP and created a Login page that allows Microsoft Entra ID based authentication, but after successfully going through Microsoft Entra ID authentication, I receive the default DLT login page.
I'm thinking the issue might be due to an incorrect redirect URI, but because of the lack of documentation about DLT I cannot figure out if this is the issue (and what's the correct redirect URI) or if it's due to something else.

[gockle]

Hi @pueblas

DLT uses Amplify for the authentication, the authentication component in the GUI configures Amplify with resources config,

const ResourcesConfig = {
  Auth: {
    Cognito: {
      userPoolId: ...
      userPoolClientId: ...
      identityPoolId: ...
    },
...
};

Amplify.configure({ ...ResourcesConfig });

The login is working but since the login is done by new Idp (Microsoft AD) the request coming to the GUI is missing attributes, If possible monitor the API requests in the browser Developer tools and provide with the error in Console (if any)

Please also review this documentation related to attribute mapping for external Idp.

[pueblas]

Hi @gockle
I reviewed what you said and there's no error in Console, but it seems the oauth attributes are missing in awsConfig, is it a possibility I need to first add them to ResourcesConfig when configuring Amplify? For instance, I found this example on Amplify docs

[gockle]

hi @pueblas
Thanks for confirming so the missing attributes can be included in the session/request, using the post authentication lambda trigger feature in cognito. The lambda should be similar to how it is configured here. Let me know if this is something that would work for your use case.