Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a corporate portal where employees must sign in using their existing SAML 2.0 Identity Provider (IdP) credentials. The portal's backend API, hosted on Amazon API Gateway, requires custom user claims such as department and employee ID to perform fine-grained authorization. Which configuration will meet these requirements with the least development effort?

  1. Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.Answer
  2. B
    Configure the SAML 2.0 IdP in a Cognito Identity Pool, map the SAML assertions to IAM principal tags, and configure API Gateway to use IAM authorization for the backend API.
  3. C
    Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to custom user pool attributes, and write a custom API Gateway Lambda authorizer to parse and validate the SAML token directly.
  4. D
    Configure the SAML 2.0 IdP in a Cognito Identity Pool, map the SAML assertions to Cognito User Pool attributes using a Custom Message Lambda trigger, and configure API Gateway to use a Cognito User Pool authorizer.

Answer

Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.
Configuring the SAML 2.0 IdP within a Cognito User Pool and mapping its assertions to user pool attributes allows the identity directory to generate JWT ID/access tokens containing the custom claims. Using the native Cognito User Pool authorizer in API Gateway validates these tokens automatically, presenting the claims to the backend integration with minimal configuration and no custom code.

Step-by-Step Solution

1
Set up a Cognito User Pool and add the SAML 2.0 IdP as a federated provider using the IdP's metadata document.
Cognito User Pool is established as the directory that federates authentication to the external corporate SAML IdP.
This establishes the identity provider trust relationship and configures the user authentication source.
2
Configure SAML attribute mapping in Cognito User Pool settings to map incoming SAML assertions (e.g., department, employee ID) to standard or custom user pool attributes.
The federated user's identity tokens generated by Cognito (ID token and Access token) will automatically contain these mapped claims.
This ensures the backend API can access the required custom claims in the authorization payload.
3
Configure an API Gateway Cognito User Pool Authorizer on the API methods, referencing the user pool.
API Gateway automatically validates the incoming ID token sent in the Authorization header and passes the claims to the backend integration context.
This performs token validation and supplies the custom claims to the API with zero custom code or Lambda execution overhead.

Key Concept

Amazon Cognito User Pools support SAML 2.0 federation and direct attribute mapping, allowing standard API Gateway Cognito Authorizers to automatically validate tokens and pass mapped claims to backend integrations without custom Lambda code.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic