Skip to content

Configure Google as Authentication Provider using the SAML2 Protocol

Here are step by step instructions for federating authentication from Cognito to Google using the SAML2 protocol

Google Admin

  • Login to Google Workspaces as an Admin and bring up the Admin console
  • Click on Apps and then clikc on Web and mobile apps
  • Click on Add App and then choose Add custom SAML app

Name the app

Provide a name for the app (e.g. InfinStor) and a description

Download IdP Metadata

Download IdP metadata in the next screen. The download file is likely to be called GoogleIDPMetadata.xml. Click next

ACS URL and Entity ID

Two important configuration items are required here:

ACS URL a.k.a redirect URL

Google calls it ACS URL and AWS Cognito calls it Redirect URL. In any case, this URL is of the format For example, a cognito domain in region us-east-1 would result in a ACS URL of

Entity ID

The Entity ID is of the format urn:amazon:cognito:sp:your-cognito-user-pool-id. For example, if your Cognito User Pool is us-east-1_LzJrxyZzy, then the Entity ID would be urn:amazon:cognito:sp:us-east-1_LzJrxyZzy

Here is an example screen capture:

Attribute Mapping

  • First, choose Google Directory Attribute Primary email and map it to email
  • Next, in the Group membership section, choose the groups that you want to map and map it to an App attribute Groups

Here's a screencapture showing attribute mapping:

Turn on User Access

Finally, turn on User Access for everyone, or a smaller subset of people. Here's a screen capture showing the summary:

Cognito Configure SAML

Now, let's setup Google as a SAML2 federated authentication provider for our Cognito User Pool

  • Go to the Cognito AWS Console and choose the User Pool infinstor-service-subscribers
  • Click on Identity Providers and then click on the tab Sign-in experience
  • Click on the Add identity provider button in the Federated Identity Providers tab
  • Choose Metadata Document and upload the file GoogleIDPMetadata.xml that you downloaded from Google earlier
  • Supply a Provider Name. Use a simple one such as google. If you choose the name google and if the user has email address, then the username composed by Cognito will be

Create new Cognito Custom Attribute custom:groups

Click on Sign-up experience tab and then click on the Add custom attributes button in the Custom attributes section. Then add a string attribute called groups. Note that when adding the attribute you would type in groups, but when Cognito displays it, it shows up as custom:groups as shown in the screen capture below.

Set Attribute Read and Write Permissions for for all app clients

Click on General Settings -> App clients on the left navbar, for each app client, enable read permission for the newly created custom attribute by clicking on the Set attribute read and write permissions

Cognito Custom Attribute Mapping

Next, browse to the Sign-in experience tab, choose the google provider, and then choose Attribute Mapping to setup attribute mappings:

  • User pool attribute email to SAML attribute Email
  • User pool attribute custom:groups to SAML attribute Groups

Here's a screen capture showing cognito custom attribute mapping

Enable Identity Provider google for all app clients

InfinStor creates app clients named mlflowui-client, web-client, jupyterhub-full-client and cli-client

Enable this new identity provider google for each of these clients by clicking on the App Integration tab, then choosing each app client, clicking on the Edit button of the Hosted UI section.

Finally, delete the Cognito auto created group your_pool_id_google

When you add an SAML provider, Cognito automatically adds a group named your_pool_id_google. All users from this authenticatino mechanism belong to this group, making it mostly useless. Delete this group.