title: Integrate AWS Cognito with Google Workspace using SAML integration
body: <p>I have some applications served to my company users on EKS (i.e., Jenkins). In company we use Google Workspaces (GSuite) for email and stuff. So I want to allow users to login with Google creds to those applications I serve. I figured out I could use Cognito to achieve it but I cannot connect those and flow end with Google showing <strong>403. Error: app_not_configured_for_user</strong>. In their <a href="https://support.google.com/a/answer/6301076?hl=en" rel="nofollow noreferrer">documentation</a> I can find:</p>
  <blockquote>
  <p>Verify that the value in the saml:Issuer tag in the SAMLRequest matches the Entity ID value configured in the SAML Service Provider Details section in the Admin console. This value is case-sensitive.</p>
  </blockquote>
  <p>but how do I debug it? I do not see a logs from neither AWS and Google sides :/</p>
  <p>I <a href="https://aws.amazon.com/premiumsupport/knowledge-center/cognito-third-party-saml-idp/" rel="nofollow noreferrer">think</a> I <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html" rel="nofollow noreferrer">followed</a> all <a href="https://alsmola.medium.com/alb-authentication-with-g-suite-saml-using-cognito-858e35564dc8" rel="nofollow noreferrer">possible</a> guides and I cannot find what I'm doing wrong. I found that Google has <a href="https://support.google.com/a/table/9217027?p=saml_apps&amp;hl=en-GB&amp;visit_id=637824413400944075-2779246935&amp;rd=1" rel="nofollow noreferrer">this page</a> but they do not provide exact scenario for AWS Cognito. Anyways all of those are very similar so I guess I shouldn't have problems, but I do have.</p>
  <p>What I did:</p>
  <ul>
  <li>In Google Admin (one for workspaces) I created &quot;Web and mobile app&quot; of SAML type</li>
  <li>I downloaded metadata file</li>
  <li>In AWS Cognito console I created User Pool</li>
  <li>I created IdP provider and uploaded metadata file there</li>
  <li>I created application client</li>
  <li>Using those values I filled fields <strong>ACS URL</strong> and <strong>Entity ID</strong> in Google Admin using values:
  <ul>
  <li>ACS URL: <code>https://my-domain-i-just-created.auth.us-east-1.amazoncognito.com/saml2/idpresponse</code></li>
  <li>Entity ID: <code>urn:amazon:cognito:sp:us-east-1_myPoolId</code></li>
  </ul>
  </li>
  <li>I also selected <strong>Name ID format</strong> to be Persisted</li>
  <li>In attribute mapping I mapped email value to <code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</code>.</li>
  <li>In AWS Cognito I enabled HostedUI and also created mapping of <code>http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</code> to email field.</li>
  </ul>
  <p>And now when I click <em>View Hosted UI</em> in AWS console it will redirect me to Google authentication and after it directly to before mentioned <strong>403 app_not_configured_for_user</strong> page.</p>
  <p>I tied it 3 times with slightly different configurations of mapping, signed responses, etc. but nothing gets me past that error.</p>
  <p>Anyone tried to integrate it?</p>