-
-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1090 from ITfoxtec/test
Test
- Loading branch information
Showing
43 changed files
with
476 additions
and
100 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| # Connect to Amazon Cognito with OpenID Connect | ||
|
|
||
| FoxIDs can be connected to Amazon Cognito with OpenID Connect and authenticate users in your Amazon Cognito user pool. | ||
|
|
||
| You can add support for SAML 2.0 to your Amazon Cognito. | ||
| By configuring Amazon Cognito as an [OpenID Connect authentication method](auth-method-oidc.md) and a [SAML 2.0 application](app-reg-saml-2.0.md) FoxIDs become a [bridge](bridge.md) between OpenID Connect and SAML 2.0 and automatically convert JWT (OAuth 2.0) claims to SAML 2.0 claims. | ||
|
|
||
| ## Configure Amazon Cognito | ||
|
|
||
| This chapter describes how to configure a connection with OpenID Connect Authorization Code flow and read the users claims from the ID token. | ||
|
|
||
| **1 - Start by creating an OpenID Connect authentication method in [FoxIDs Control Client](control.md#foxids-control-client)** | ||
|
|
||
| 1. Navigate to the **Authentication** tab | ||
| 2. Click **New authentication** | ||
| 3. Select **OpenID Provider** | ||
| 4. Add the **Name** e.g. Amazon Cognito | ||
|  | ||
|
|
||
| 5. Read the **Redirect URL** and **Post logout redirect URL** and save it for later | ||
|
|
||
| **2 - Then go to the Amazon Cognito [AWS portal](https://aws.amazon.com/) and create the a new app client** | ||
|
|
||
| 1. Navigate to **Amazon Cognito** | ||
| 2. Select **User pools** | ||
|  | ||
| 3. Select existing user pool or create a new user pool | ||
| 4. Find **Applications** in the menu and click **App clients** | ||
| 5. Click **Create app client** in the top right corner | ||
| 6. Select **Traditional web application** | ||
| 7. Add the name in **Name your application** e.g. FoxIDs | ||
| 8. Add the FoxIDs **Redirect URL** from before in the **Return URL** field | ||
|  | ||
| 9. Click **Create app client** | ||
| 10. Read the **Client ID** and **Client secret** and save it for later | ||
|  | ||
| 11. Click **Login pages** and click **Edit** | ||
| 12. Find **Allowed sign-out URLs - optional** click **Add sign-out URL** | ||
| 13. Add the **Post logout redirect URL** from FoxIDs in the **URL** field | ||
|  | ||
| 14. You can optionnaly configure aditionally scopes like `phone` and `profile` | ||
| 15. Click **Save changes** | ||
| 16. Find the **View quick setup guide** and example code | ||
| 17. Find the **authority** in the example code (it is also called **issuerURL**) and save it for later | ||
| The authority is in this example is `https://cognito-idp.eu-north-1.amazonaws.com/eu-north-1_3nLCUMELB` | ||
|
|
||
| **3 - Go back to the FoxIDs authentication method in [FoxIDs Control Client](control.md#foxids-control-client)** | ||
|
|
||
| 1. Add the **Authority** from Amazon Cognito | ||
|  | ||
| 2. Click **Show advanced** in the top right corner of this configuration section | ||
| 3. Add the **Optional custom SP client ID** from Amazon Cognito called **Client ID** | ||
| 4. Add `email` to the **scopes** list, you can possible configure the scopes `phone` and `profile` in Amazon Cognito and FoxIDs | ||
| 5. Add the **Client secret** from Amazon Cognito | ||
| 6. Set the **Read claims from the ID token instead of the access token** switch to **Yes** | ||
| 7. As **Response mode** select **query** | ||
|  | ||
| 8. Click **Create** | ||
| 9. Click **Test authentication** to test the Amazon Cognito connection | ||
|
|
||
| That's it, you are done. | ||
|
|
||
| Your new Amazon Cognito authentication method can be selected as an allowed authentication method in an application registration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Connect to Amazon IAM Identity Center with SAML 2.0 | ||
|
|
||
| FoxIDs can be added as an external identity provider for Amazon IAM Identity Center with SAML 2.0. | ||
|
|
||
| By configuring an [OpenID Connect authentication method](auth-method-oidc.md) and Amazon IAM Identity Center as a [SAML 2.0 application](app-reg-saml-2.0.md) FoxIDs become a [bridge](bridge.md) between OpenID Connect and SAML 2.0 and automatically convert JWT (OAuth 2.0) claims to SAML 2.0 claims. | ||
|
|
||
| ## Configure Amazon IAM Identity Center | ||
|
|
||
| This guide describe how to setup FoxIDs as an external identity provider for Amazon IAM Identity Center. Users is connected with there email address and is required to exist in Amazon IAM Identity Center. | ||
|
|
||
| **1 - Start by configuring a certificate in [FoxIDs Control Client](control.md#foxids-control-client)** | ||
|
|
||
| You are required to upload the SAML 2.0 metadata from FoxIDs to Amazon IAM Identity Center. It is therefor necessary to use a long living certificate in FoxIDs, e.g. valid for 3 years. | ||
|
|
||
| 1. Select the **Certificates** tab | ||
| 2. Click **Change Container type** | ||
|  | ||
| 3. Find **Self-signed or your certificate** and click **Change to this container type** | ||
| 4. The self-signed certificate is valid for 3 years, and you can optionally upload you own certificate | ||
|  | ||
|
|
||
|
|
||
| **2 - Then go to the Amazon IAM Identity Center in [AWS portal](https://aws.amazon.com/)** | ||
|
|
||
| 1. Navigate to **Amazon IAM Identity Center** | ||
| 2. Click **Settings** | ||
| 3. Click **Choose identity source** (may be located in the **Identity source** section and **Actions** button) | ||
| 4. Select **External identity provider** | ||
| 5. Click **Next** | ||
| 6. Copy the **IAM Identity Center Assertion Consumer Service (ACS) URL** and save it for later | ||
| 7. Copy the **IAM Identity Center issuer URL** and save it for later | ||
|  | ||
|
|
||
| **3 - Then creating an SAML 2.0 application in [FoxIDs Control Client](control.md#foxids-control-client)** | ||
|
|
||
| 1. Select the **Applications** tab | ||
| 2. Click **New application** | ||
| 3. Click **Show advanced** | ||
| 4. Click **Web application (SAML 2.0)** | ||
| 5. Add the **Name** e.g. `Amazon IAM Identity Center` | ||
| 6. Add the **Application issuer** from Amazon IAM Identity Center called **IAM Identity Center issuer URL** | ||
| 7. Add the **Assertion consumer service (ACS) URL** from Amazon IAM Identity Center called **IAM Identity Center Assertion Consumer Service (ACS) URL** | ||
|  | ||
| 8. Click **Register** | ||
| 9. Click **Close** | ||
| 10. Find the application in the list and click on it to edit | ||
| 11. Click **Show advanced** | ||
| 12. Set the **Authn request binding** to **Post** | ||
| 13. Set the **NameID format** to `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` | ||
|  | ||
| 14. Set the **NameID format in metadata** to `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` at the bottom of the application | ||
| 15. Click **Update** | ||
| 16. Go to the top of the application and click the **SAML 2.0 Metadata URL** link to open it in a browser | ||
| 17. Download the metadata as a metadata file | ||
|
|
||
| **4 - Go back to the Amazon IAM Identity Center in [AWS portal](https://aws.amazon.com/)** | ||
|
|
||
| 1. Find the **IdP SAML metadata** and click **Choose file** | ||
| 2. Select the metadata file from FoxIDs | ||
| 3. Click **Next** | ||
| 4. Write **ACCEPT** | ||
| 5. Click **Change identity source** | ||
| 6. Find the **Identity source** section and the **AWS access portal URL**, click the link to test login (you may need to create a user in FoxIDs) | ||
|
|
||
| > Amazon IAM Identity Center do not support logout. |
Oops, something went wrong.