4 ms·
Eh? Brokering amongst multiple trusts (and managing protocol transition) is almost the raison d'etre for lifting token issuance out of your app and into ADFS,
by sk5t 6y ago
Eh? Brokering amongst multiple trusts (and managing protocol transition) is almost the raison d'etre for lifting token issuance out of your app and into ADFS, Okta, Auth0, etc.
Of course you'll have to deal with home realm discovery--really need to go in with open eyes on that one.
- drfritznunkie 6y agoYes, but cognito endpoints and pools ids are regional and globally unique, and there is no way that I know of to setup duplicate userpools in multiple regions and have requests served by either region. That means the customer IDP side would need to have two different SAML apps configured for each region...
- sk5t 6y agoAh, I see what you mean. It does seem like you'd want a more complex arrangement of trusts to keep things simple on the leaves; or else avoid using a product that requires generating a hundred scattered security authorities.
- myleshenderson 6y agoThis was shared with me today: https://medium.com/@nealrp/aws-cross-region-cognito-replication-c764da1f29c0 https://medium.com/@nealrp/aws-cross-region-cognito-replicat...