AWS cognito: Document AcrMapping for federated IdP step-up
Summary
Adds guidance that OIDC/OAuth IdP ACR values can be mapped to Cognito authentication levels with the AcrMapping field.
Security assessment
Describes configuring authentication-level mapping for federated users, directly relevant to step-up authentication and access control decisions.
Evidence
+For an OIDC or OAuth IdP, you can map the ACR values of the IdP to Amazon Cognito authentication levels with the `AcrMapping` field to support step-up authentication for federated users. For more information, see [Step-up authentication for federated users](./cognito-user-pools-oidc-idp.html#cognito-user-pools-step-up-federation).
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-identity-provider.md b/cognito/latest/developerguide/cognito-user-pools-identity-provider.md index 882200d..08f50c3 100644 --- a//cognito/latest/developerguide/cognito-user-pools-identity-provider.md +++ b//cognito/latest/developerguide/cognito-user-pools-identity-provider.md @@ -16,0 +17,2 @@ The **Social and external providers** menu under **Authentication** adds and upd +For an OIDC or OAuth IdP, you can map the ACR values of the IdP to Amazon Cognito authentication levels with the `AcrMapping` field to support step-up authentication for federated users. For more information, see [Step-up authentication for federated users](./cognito-user-pools-oidc-idp.html#cognito-user-pools-step-up-federation). +