Integrate AWS Cognito with Google Workspace using SAML integration

Question

I have some applications served to my company users on EKS (i.e., Jenkins). In company we use Google Workspaces (GSuite) for email and stuff. So I want to allow users to login with Google creds to those applications I serve. I figured out I could use Cognito to achieve it but I cannot connect those and flow end with Google showing 403. Error: app_not_configured_for_user. In their documentation I can find:

Verify that the value in the saml:Issuer tag in the SAMLRequest matches the Entity ID value configured in the SAML Service Provider Details section in the Admin console. This value is case-sensitive.

but how do I debug it? I do not see a logs from neither AWS and Google sides :/

I think I followed all possible guides and I cannot find what I'm doing wrong. I found that Google has this page but they do not provide exact scenario for AWS Cognito. Anyways all of those are very similar so I guess I shouldn't have problems, but I do have.

What I did:

• In Google Admin (one for workspaces) I created "Web and mobile app" of SAML type
• I downloaded metadata file
• In AWS Cognito console I created User Pool
• I created IdP provider and uploaded metadata file there
• I created application client
• Using those values I filled fields ACS URL and Entity ID in Google Admin using values:
  • ACS URL: https://my-domain-i-just-created.auth.us-east-1.amazoncognito.com/saml2/idpresponse
  • Entity ID: urn:amazon:cognito:sp:us-east-1_myPoolId
• I also selected Name ID format to be Persisted
• In attribute mapping I mapped email value to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress.
• In AWS Cognito I enabled HostedUI and also created mapping of http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress to email field.

And now when I click View Hosted UI in AWS console it will redirect me to Google authentication and after it directly to before mentioned 403 app_not_configured_for_user page.

I tied it 3 times with slightly different configurations of mapping, signed responses, etc. but nothing gets me past that error.

Anyone tried to integrate it?

Answer 1

How to troubleshoot the 403 app_not_configured_for_user error related to SAML apps from the Google Workspace Admin console

The first thing you need to do is to grab a HAR file recording the whole login process and find the SAML request. Steps can be found here.

Once you get the file you can open it using that tool and search for SAMLreq at the top right (see image).

After that you will get a list of values containing information. You will have to check one by one until you find the one that has the SAML request in the request tab (see example below).

Once you get the value from the SAML request, copy it and you can use this tool to do a SAML decode and find the entity ID. You can use Ctrl + F and search for saml:Issuer to find the value faster. If the value does not match, then you know you have an error and you will need to contact the support team from the app to see which value is the correct one.

In case the value matches I would recommend opening a ticket to check with Google.