DEPRECATED This page describes the legacy SSO configuration for AWS Cognito. For new installations or migrations, see SSO OIDC (OpenID Connect).
Migration equivalences
Correspondence table between the legacy properties and the new OIDC configuration:
|
Legacy property |
New property / Action |
|---|---|
|
|
Remove - they are discovered automatically. Replace with |
|
|
|
|
|
|
|
|
Remove |
|
|
Remove - by default |
|
|
Remove - it is generated automatically as |
|
|
Replace with |
|
|
Remove |
|
|
|
|
|
Remove - incorporate into |
|
|
Migrate to |
|
|
Available at |
Integration model
Authentication (OAuth2)
The functionality is directly embedded in the Zeus authentication management microservice; it is enabled and configured through that microservice's configuration file.
Authentication configuration
The different authentication providers used are configured in the security.authentication property.
In the case of AWS, the following properties need to be configured:
security:
authentication:
oidc:
providers:
aws:
# Name of the provider as it will appear on the login page
name: Anjana AWS
# Provider URL to authorize Anjana Portal users (use variables in the URL)
authorize-url: https://${security.authentication.oidc.providers.aws.domain}.auth.${security.authentication.oidc.providers.aws.region}.amazoncognito.com/login?response_type=code&client_id=${security.authentication.oidc.providers.aws.client-id}&redirect_uri=${security.authentication.oidc.providers.aws.redirect-uri}&state=STATE&scope=${security.authentication.oidc.providers.aws.scopes}
# Provider URL to authorize Portuno users (use variables in the URL)
authorize-url-portuno: https://${security.authentication.oidc.providers.aws.domain}.auth.${security.authentication.oidc.providers.aws.region}.amazoncognito.com/login?response_type=code&client_id=${security.authentication.oidc.providers.aws.client-id}&redirect_uri=${security.authentication.oidc.providers.aws.redirect-uri-portuno}&state=STATE&scope=${security.authentication.oidc.providers.aws.scopes}
# Provider URL to manage token creation
token-url: https://${security.authentication.oidc.providers.aws.domain}.auth.${security.authentication.oidc.providers.aws.region}.amazoncognito.com/oauth2/token
# Scope of the provider's authentication
scopes: openid+profile
# Authentication client identifier at the provider
client-id: <client-id>
# Authentication client secret at the provider
client-secret: <client-secret>
# Provider's authentication method
client-authentication-method: GET
# URI the browser must redirect to after a successful login with the provider in the Anjana Portal
redirect-uri: https://<host>/authorized
# URI the browser must redirect to after a successful login with the provider in the administrative portal (Portuno)
redirect-uri-portuno: https://<host>/configpanel/authorized
# Field where the username is found at the provider
username-claim: cognito:username
# Authentication type according to the OAuth2 definition
workflowType: AUTHORIZATION_CODE
# Authorization server URL to call to obtain the user's information
authorizeServer: https://${security.authentication.oidc.providers.aws.domain}.auth.${security.authentication.oidc.providers.aws.region}.amazoncognito.com/oauth2/userInfo
# Property in which the username from the authorization server is collected.
userNameProperty: username
# Provider type
type: AWS
# AWS IAM region, used to generate the authorization URLs
region: eu-web-1
# AWS IAM domain, used to generate the authorization URLs
domain: anjana-app-desarrollo
# User pool identifier
poolID: <poolID>
# Access key of the admin user used to retrieve users
accessKey: <accessKey>
# Secret of the access key of the admin user used to retrieve users
secretKey: <secretKey>
Active governance
The plugin to deploy that will handle the active governance tasks that need to provision elements on AWS is "Tot plugin AWS IAM".
Required credentials
The credential can be a single one combining the permissions of both, but it is recommended to keep them separate to facilitate monitoring and auditing of the activity performed by them.
Authentication
The functionality is directly embedded in the Zeus authentication management microservice; it is enabled and configured through that microservice's configuration file.
It is necessary to register a user group (User Pool) in the Amazon Cognito service for OAuth2 applications; it will need to be given a name.
After creating the user pool, further configuration is required in the "App clients" section, and within the client that has been created, the following configuration must be retrieved:
-
Client ID
-
Client secret
In addition, a Login page will need to be configured, along with the following:
-
the URLs matching the domain name that routes to the Anjana Data frontend; it is necessary to register:
-
Callback URLs:
-
https://<host>/authorized
-
https://<host>/login
-
https://<host>/configpanel/authorized
-
https://<host>/configpanel/login
-
-
Sign-out URLs
-
https://<host>/logout
-
https://<host>/configpanel/logout
-
-
-
OAuth2 grant type
-
Here, whichever flow type is preferred
-
Finally, in the Branding / Domain section, the Cognito domain must be edited - it will come with a concatenation of the region and a hash - and filled in with an identifying name in lowercase and without special characters such as spaces (it is a URL).
Active governance
The plugin to deploy that will handle the active governance tasks that need to provision elements on AWS is "Tot plugin AWS IAM"; the required credential is described in its documentation.
SSO emulation via OAuth2
The OAuth2 protocol supports transparent authentication whenever possible; to achieve this, it is only necessary to redirect the user to https://<host>/provider=<provider identifier in zeus>. If the user is already logged in with that provider and the policies configured for that provider mean the credential does not need to be validated again, the user will be authenticated in Anjana Data completely transparently.