是否有可能在 SAML 响应进入认知之前拦截它？

Question

How it works with Cognito is that you map groups with SAML response, but the problem arrives while mapping groups with SAML response for the user that is in many groups because of which then custom attributes exceed 2048 characters limit.

I would like to pick up groups from SAML response, pick only necessary for an application use case, and then forward it to Cognito where jwt is generated.

In the AWS documentation it's recommended to filter the mapped groups:

Recommended: Filter the mapped groups to only those that are relevant to the application (for example, by a prefix filter). There is a 2,048-character limit on the custom attribute, so filtering avoids exceeding the character limit and also avoids passing irrelevant information to the application.

So, the question is how can I filter the mapped groups programmatically before they get to the Cognito?

Answer 1

As you are working with a SAML response, Im assuming that you are trying to integrate with ADFS or Azure AD. We managed to resolve the same issue in both by applying a filter (prefix filter) before adding the claims to the SAML response on the AD end.