I’m using AWS Cognito as User pool (for login) <> Auth0 as SAML-IDP (idp-initiated flow) (as Cognito does not support SAML IDP) <> and connecting to 3rd party SP.
I have a web-app which has login mechanism with AWS Cognito, and I’m trying to redirect logged-in customers to third-party URL (=SP, which requires log-in as well, SAML).
I have setup Auth0 to perform the SAML SSO, as Cognito does not support it and added OpenID Connect for authentication, to sync my existing users with Auth0 (AWS Cognito - see image below), which seems to work well (users are synced from my user-pool with Auth0/User Management/Users).
When i’m redirecting my logged in users, I redirect them to Auth0 Identity Provider Login URL (i.e: dev-APP.us.auth0.com/samlp/SOME_APP?connection=AWSCognito)
the problem i’m facing is that for the first time - user is required to log-in again (to cognito) although he was already logged in (see image below).
I was trying to follow up the requests made after redirection to Auth0 Provider Login URL and it seems that /authorize URL on cognito is the issue (https://XXXXX.auth.us-east-1.amazoncognito.com/oauth2/authorize)
Redirecting directly to AWS Cognito Domain with this URL won't work as well (to Hosted UI rather than to Auth0 URL): https://<yourDomainPrefix>.auth.<region>.amazoncognito.com/login?response_type=token&client_id=<yourClientId>&redirect_uri=<redirectUrl> where the redirectURI is URLEncoded
Is there any way to skip that second login (first in my web-app and second is the Cognito hosted UI)?
thanks!
