I did manage to fix it authn request and response was same problem was that i had in configuration:
"skipGeneratingSubjectConfirmationInResponseTo": true, When i change it to false or remove it from service it started to work wtorek, 23 czerwca 2026 o 19:34:44 UTC+2 Ray Bon napisał(a): > Arkady, > > Use a browser plugin, like SAMLtracer, to see what is in the authn request > and response. > > Ray > ------------------------------ > *From:* [email protected] <[email protected]> on behalf of Arkady > Keppert <[email protected]> > *Sent:* June 23, 2026 02:42 > *To:* CAS Community <[email protected]> > *Subject:* [cas-user] CAS SAML2 Integration Issue with Amazon Cognito > (InResponseTo mismatch) > > You don't often get email from [email protected]. Learn why this is > important <https://aka.ms/LearnAboutSenderIdentification> > Hello everyone, > > I'm experiencing an issue with a SAML2 integration and I’ve run out of > ideas on what might be wrong. > Setup I am using: > > Apereo CAS 7.3.7 > Acting as SAML Identity Provider (IdP) > Behind HAProxy > Integrating with Amazon Cognito as the Service Provider (SP) > > They provided the following configuration: > Audience URI (EntityID): > urn:amazon:cognito:sp:us-west-2_xxxxxxx > Assertion Consumer Service (ACS) URL: > https://xxx-xxxx.login.moodys.com/saml2/idpresponse > > Required SAML Attributes > The SP requires the following attributes (case-sensitive): > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress → user > email (required) > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → first > name (required) > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → last name > (required) > http://schemas.xmlsoap.org/claims/Group → groups (recommended) > corp_id → optional identifier > Flow description > > > The login flow is as follows: > I open a login link provided by Cognito, I enter my email address Cognito > redirects me to CAS for authentication I successfully authenticate in CAS > After successful authentication, Cognito returns an error: > "message": "An error occured during federate callback. Error: > 'server_error', > ErrorDescription: 'Invalid SAML response received: InResponseTo attribute > in the SAML response does not match the ID that was sent with the SAML > authentication request'" > CAS logs warning > > I also see the following warning in CAS logs: > WARN [org.opensaml.saml.common.binding.SAMLBindingSupport] - > Relay state exceeds 80 bytes: > [REDACTED - long encoded SAML state] > > CAS SAML service configuration > { > "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService", > > "serviceId": "urn:amazon:cognito:sp:us-west-2_xxxxxxx", > "name": "Moodys", > "id": 33, > "evaluationOrder": 33, > > "description": "Moody's SAML Integration", > > "metadataLocation": "file:/etc/cas/saml/sp-metadata/moodys.xml", > > "skipGeneratingSubjectConfirmationInResponseTo": true, > > "signAssertions": true, > "signResponses": true, > "encryptAssertions": false, > > "attributeReleasePolicy": { > "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", > "allowedAttributes": { > "@class": "java.util.TreeMap", > "email": " > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";, > "imie": " > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";, > "nazwisko": " > http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"; > } > } > } > > At the beginning, the SP did not want to provide metadata. Instead, they > asked whether I could simply configure the ACS URL directly in the CAS > service definition. > > Later, they provided a metadata file generated using: > https://www.samltool.com/sp_metadata.php > > <?xml version="1.0" encoding="UTF-8"?> > <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" > entityID="urn:amazon:cognito:sp:us-west-2_xxxxxxx"> > <md:SPSSODescriptor > protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> > > <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat> > <md:AssertionConsumerService > Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" > Location="https://xxxx-xxxx.login.moodys.com/saml2/idpresponse"; > index="0" > isDefault="true"/> > </md:SPSSODescriptor> > </md:EntityDescriptor> > > > > I’m running out of ideas what could be wrong. > It seems that CAS successfully authenticates the user, but Cognito fails > during the SAML callback with: > InResponseTo attribute in the SAML response does not match the ID that was > sent with the SAML authentication request > Has anyone experienced a similar issue with CAS acting as IdP and Amazon > Cognito as SP, especially in an IdP-initiated flow? > Any hints would be greatly appreciated. > > I also have several other SAML integrations configured in CAS that work > without any issues, so the CAS SAML setup in general is functional. > > -- > - Website: https://apereo.github.io/cas > - List Guidelines: https://goo.gl/1VRrw7 > - Contributions: https://goo.gl/mh7qDG > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/2bc62562-c00b-4d09-ab9e-cab8185590can%40apereo.org > > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/2bc62562-c00b-4d09-ab9e-cab8185590can%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/031bfb9d-a1bc-414c-8313-062828257809n%40apereo.org.
