Amazon Cognito supports multi-tenant applications with a single user pool by mapping SAML custom attributes like tenantName from an external identity provider (IdP) to authorize tenant-specific access.

<div>
<p>This article discusses how to use a single Amazon Cognito user pool to support a multi-tenant application while integrating with multiple SAML identity providers (IdPs) like Google Workspace, Okta, or Active Directory Federation Services (AD FS).</p>
<p>Specifically, the article covers:</p>
<ul>
<li>Using a single Cognito user pool for multiple customers</li>
<li>Configuring SAML integration with each customer's IdP in Cognito</li>
<li>Mapping IdP attributes like email and groups to Cognito user attributes</li>
<li>Using a Lambda function to retrieve tenant details from a DynamoDB table based on the user's email domain</li>
<li>Adding custom attributes like tenantName to the Cognito JWT token for multi-tenancy</li>
<li>Implementing a demo application architecture with AWS services like API Gateway, Lambda, DynamoDB, and Amplify</li>
<li>Conclusion on using Cognito for multi-tenant applications with external IdPs</li>
</ul>
</div>


Use SAML with Amazon Cognito to support a multi-tenant application with a single user pool

Related articles