blocks|key|2329415|text|this+link中记录了如何使用Cognito设置ADFS。回答您问题的部分是第4步第5项中的映射。我将相关文本复制到下面：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2329416|Choose+Attribute+mapping.++These+mappings+map+the+claims+from+the+SAML+assertion+from+AD+FS+to+the+user+pool+attributes.|style|CODE|2329417|确保ADFS正在发送断言中的组。对于设置组的ADFS端，this+link可能很有用。|2329418|你可以在火狐中使用SAML-tracer插件来调试这个流程。|2329419|entityMap|0|LINK|mutability|MUTABLE|url|https://aws.amazon.com/blogs/mobile/building-adfs-federation-for-your-web-app-using-amazon-cognito-user-pools/|1|https://docs.pivotal.io/p-identity/1-6/adfs/config-adfs.html#adfs-groups|2|https://addons.mozilla.org/es/firefox/addon/saml-tracer/^0|0|9|0|0|0|3C|0|S|9|1|0|9|B|2|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|6|7|11|8|@$A|12|B|13|F|G]]|9|@]|C|$]]|$1|H|3|I|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|J|3|K|5|6|7|18|8|@]|9|@$A|19|B|1A|1|1B]]|C|$]]|$1|L|3|-4|5|6|7|1C|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]|T|$5|O|P|Q|C|$R|U]]|V|$5|O|P|Q|C|$R|W]]]]

How to setup ADFS with Cognito is documented in <a href="https://aws.amazon.com/blogs/mobile/building-adfs-federation-for-your-web-app-using-amazon-cognito-user-pools/" rel="nofollow noreferrer">this link</a>. The section answering your question is the mapping in step 4, item 5. I'm copying the relevant text below:

<code>Choose Attribute mapping. These mappings map the claims from the SAML assertion from AD FS to the user pool attributes.</code>

Make sure that ADFS is sending the groups in the assertions. For setting up the ADFS side for groups <a href="https://docs.pivotal.io/p-identity/1-6/adfs/config-adfs.html#adfs-groups" rel="nofollow noreferrer">this link</a> might be useful. 

You could debug the flow with <a href="https://addons.mozilla.org/es/firefox/addon/saml-tracer/" rel="nofollow noreferrer">SAML-tracer</a> plugin in Firefox.

blocks|key|2541129|text|我也遇到了同样的问题，而且我也没有在Cognito中找到静态映射选项。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2541130|我看到的唯一方法是将AD组映射到Cognito中的custom:adgroups属性，并设置Cognito“预令牌生成”lambda触发器。lambda读取custom:adgroups的值，并手动覆盖用户的Cognito组。|2541131|注意--这并不会永久地改变认知用户组，只是在当前会话中，但从应用程序的角度来看，这正是我所需要的。|2541132|请参阅此处的虚拟静态(非条件)管理员组分配示例：|2541133|def+lambda_handler(event,+context):
print(f'incoming+event:+{json.dumps(event)}')

#+manual+cognito+group+override
if+event['triggerSource']+==+"TokenGeneration_HostedAuth":
++++event['response']+=+{
++++++++++++"claimsOverrideDetails":+{
++++++++++++++++"groupOverrideDetails":+{
++++++++++++++++++++"groupsToOverride":+[
++++++++++++++++++++++++"ADMIN"
++++++++++++++++++++]
++++++++++++++++}
++++++++++++}
++++++++}

return+event|code-block|syntax|javascript|2541134|更详细的文档在这里：https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html|offset|length|2541135|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html^0|0|0|0|0|0|A|2S|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|11|8|@]|9|@]|A|$]]|$1|H|3|I|5|J|7|12|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|13|8|@]|9|@$O|14|P|15|1|16]]|A|$]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

I had the same issue, and I have not found a static mapping option in Cognito either. 

The only way I see is to map the AD groups to custom:adgroups attribute in Cognito, and set up a Cognito "Pre Token Generation" lambda trigger. The lambda reads the value of the custom:adgroups and manually overrides the user's Cognito groups.

NB - this does not change the cognito user's group permanently, only for the current session, but from the application perspective that's exactly what I needed.

Please see a dummy static (non conditional) ADMIN group assignment example here:

<pre><code>def lambda_handler(event, context):
print(f'incoming event: {json.dumps(event)}')

# manual cognito group override
if event['triggerSource'] == "TokenGeneration_HostedAuth":
 event['response'] = {
 "claimsOverrideDetails": {
 "groupOverrideDetails": {
 "groupsToOverride": [
 "ADMIN"
 ]
 }
 }
 }

return event
</code></pre>

More detailed documentation here: <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html</a>

blocks|key|2329466|text|您可以使用Post+authentication+Lambda+trigger根据AD中的组更新Cognito+User+Pool中的用户组吗？您可以使用API：AdminAddUserToGroup和AdminRemoveUserFromGroup。这种方法的唯一问题是，如果您在AD中更改了用户组，那么在用户再次向Cognito进行身份验证之前，它不会在Cognito中更新。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2329467|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-authentication.html^0|29|J|2T|O|5|Y|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]|$9|Q|A|R|B|C]]|D|@$9|S|A|T|1|U]]|E|$]]|$1|F|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

Could you use the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-authentication.html" rel="nofollow noreferrer">Post authentication Lambda trigger</a> to update the user's group in the Cognito User Pool based off the group in AD? You could use the APIs: <code>AdminAddUserToGroup</code> and <code>AdminRemoveUserFromGroup</code>. The only issue with this approach is that if you change the user's group in AD, it won't be updated in Cognito until the user authenticates to Cognito again.

An app is communicating via the Open ID Connect protocol with AWS Cognito, which is connected to ADFS, communicating via SAML. Cognito is essentially "proxying" the ADFS server.

ADFS holds a group mapping that the app requires, and I would like to import these groups into Cognito as actual Cognito Group - which will then be read by the app from the <code>cognito:groups</code> from the ID-token Cognito provides.

In the AWS Cognito User Pool setup, I don't see a way to map ADFS groups to Cognito Groups - must I absolutely rely on a custom attribute for my User Pool that I can map to the ADFS-property, or am I missing some piece of configuration that allows Cognito to create new groups on the fly and automatically assign the users to the groups in Cognito?

edit: To clarify, Is it possible setup Cognito to add/create groups (not as a custom property, but a actual manageable cognito groups) when it imports users?

AWS Cognito - create groups from ADFS as Cognito Groups

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

应用程序通过开放式ID连接协议与AWS Cognito进行通信，该协议连接到ADFS，通过SAML进行通信。Cognito本质上是“代理”ADFS服务器。ADFS拥有应用程序所需的组映射，我想将这些组作为实际的Cognito组导入到Cognito中-然后应用程序将从cognito:groups中从Cognito提供的I...

问AWS Cognito -从ADFS创建组作为Cognito组
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问AWS Cognito -从ADFS创建组作为Cognito组EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问AWS Cognito -从ADFS创建组作为Cognito组
EN