2

I'm trying to configure AWS Cognito to work with ADFS as a SAML provider in a dotnet core 3.1 MVC application. I believe I have ADFS and Cognito correctly configured as I can log into the application using a user in ADFS. I am at a stage where I can login and logout, however when logging out ADFS throws the error:

MSIS7054: The SAML logout did not complete properly.

This does still log the user out of ADFS. I think I’ve narrowed it down to the SAML logout messages ADFS receives need to be signed. References: here, here and here

Amazon describe how to do this from there end

To set up the SAML IdP to add a signing certificate: To get the certificate containing the public key which will be used by the identity provider to verify the signed logout request, choose Show signing certificate under Active SAML Providers on the SAML dialog under Identity providers on the Federation console page.

However, I’m not sure how I take their public key (which is just a string) and provided that to ADFS. The only thing I can seem to find is an encryption tab, that takes a certificate file (Is there some conversion thing I need to do?). I have tried this, which is putting the key inside a .cert file and adding to the relaying party encryption tab of ADFS, however this did not work.

Any help would be appreciated.

Thanks, Adam

Adam
  • 482
  • 1
  • 8
  • 18
  • I don't have access to AWS but I seem to remember you can add it to the SAML Provider page. Have you checked this [link](https://aws.amazon.com/blogs/mobile/building-adfs-federation-for-your-web-app-using-amazon-cognito-user-pools/) ? Step 4.3 looks like the one you need (with a checkbox to "Enable IdP Signout Flow"). Then another text box appears where you can paste the public key – Simply Ged Jan 21 '22 at 06:34
  • Hi, I can confirm I have the IDP sign out flow enabled, but I'm not sure which text box you are talking about. The 'identifiers' one will not fit the key and the 'provider name' from my understanding is just the name of the SAML provider you are creating. – Adam Jan 21 '22 at 09:12

1 Answers1

0

I eventually solved the issue by taking the key from AWS Cognito and putting it in a .crt file like this said, but instead adding it to the signature tab rather than the encryption tab in the relaying trust party's properties in ADFS.

Adam
  • 482
  • 1
  • 8
  • 18