Setting up SAML as F5 IDP to work with Amazon Cognito

[jdewing]

Has anyone setup F5 SAML to work with Amazon Cognito.  I'm getting error message "Invalid RelayState from Identity Provider".

I tried with different endpoint for Relay State.  No Luck.

Local IdP Services

IdP Entity ID: https://test01.caci.com/cognito

Assertion Settions:

• Assertion Subject Type: Persistent Identifier
• Assertion Subject Value: %{sessionlogon.last.username)
• Authentication Context Class Reference: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

SAML attributes:

• Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• Values: %{session.ldap.last.attr.userPrincipalName}

External SP Connectors Configuration:

Service Provider Entity ID: urn:amazon:cognito:sp:us-gov-west-1_PewQe5b4r

Relay State: ????

Assertion Consumer Services:  https://test01.auth-fips.us-gov-west-1.amazoncognito.com/saml2/idpresponse

Metadata XML file has been uploaded to Amazon Cognitio