Our project requires MFA, so I am in the process of setting up a 3rd party IdP. Since our cloud gateway is already running on AWS, I tried to use Amazon Cognito but ran into issues logging users out because it does not return the state param. This has been a known issue for quite some time but I have not seen recent activity around it. [Forum Post].
I am now configuring Auth0, but the cost seems to be significant as our project scales.
I am curious if others have either 1.) found a way to make Cognito work or 2.) if you recommend a different provider that works well for your project.
The only thing I require is Authentication with MFA that can then map to user roles and security levels I have configured in our Ignition project to manage authorization. I'd also like to be able to integrate data from the IdP into a SIEM eventually.
Thanks in advance!
Sean, you say you have ran into issues logging users out, but I have been able to log users out successfully using Cognito. Do you not get the prompt below after logging out?
For Auth0, they have a free tier. Does it not include MFA? Are you exceeding the monthly user count? There's lots of other IdP providers and I would just start searching for one meeting your requirements and just price them out. I've played with self-hosting some and there's definitely some that are easier to use than others, but that's always an option for an entirely free but self-supported option.
On the Ignition Gateway->Config->Identity Providers->Your IdP Settings, you will find a section called Provider Configuration/Logout URL. Here, your URL should look like this:
https://us-west-2mpjm6ba4s.auth.us-west-2.amazoncognito.com/logout?client_id=45j95lura301s0bsv3mid26voo&logout_uri=https://localhost:8088/data/perspective/client/YourProject
Notice the /logout? reference and the logout_uri path to your project
Then, be sure the URL to your project is listed in the "Allowed sign-out URLs - optional" section in Cognito. That's it...Ignition will invalidate the session by sending you to the logout URL and Cognito returning the call back to Ignition. You won't see the long URL you pasted in the browser when it all works correctly.
