Integration Guide for AWS Cognito

Introduction

This guide provides information on how to:

• Set up Beyond Identity as a Passwordless login provider for applications that use AWS Cognito to manage their identities. 

Prerequisites:

1. Administrator user privileges to AWS console. 

1. USER Pool setup:

1. Login to the AWS cognito console as an administrator.
2. Click on “Manage User Pools”
3. Click on “Create a user pool”
4. Under the Name provide a pool name and click on “Step through settings”
5. Under Attributes select how you want end users to sign in. ex:

6. Under which standard attributes are required select email, family name, given name and name. 

7. Leave out Do you want to add custom attributes.
8. Leave the default values for policies.
9. Select appropriate values for MFA. Ex:

10. Leave the default settings for Message customizations, tags and devices.
11. Under the App clients

12. Click on Create App client. 
13. Leave the default values in Triggers
14. Hit Create Pool.

2. Configure bi as the idp:

1. Navigate to Federation🡪Identity Providers.
2. Click on OpenID connect and configure a new Provider as below.
3. Client ID and Secret will be generated from BI Admin console (Refer to the section)

4. Navigate to Federation🡪Attribute Mapping
5. Configure the OIDC Mappings for newly created BI IDP as below

3. APP CLient settings on cognito

1. Navigate to App Integration 🡪App client settings.
2. Under Enabled Identity Providers select Beyond-Identity.
3. Under Callback URL(s) enter your application’s redirect URL

e.g. https://solemate.me/api/auth/callback/cognito

     4.  Select the below values for OAuth 2.0 flows and scopes.

6. Navigate to App Integration 🡪 Domain Name and provide an amazon Cognito domain name. 
7. Leave the UI customization and Resource server settings at default. 

4. settings on the app:

1. Configure App client Id and Client secret from Cognito (User Pool 🡪General Settings 🡪 App Clients) on your App.
2. Configure Cognito Issuer URL for your app (User Pool 🡪 App Integration  🡪Domain Name)
   1. E.g. https://cognito-idp.auth.<aws-region>.amazoncongnito.com/<User-Pool-ID>
   2. E.g. https://<beyond-b2c>.auth.us-east-2.amazoncognito.com

5. Beyond Identity Admin console settings:

1. Navigate to Integrations🡪OIDC.
2. Configure the Name and Redirect URI accordingly. 

e.g. Redirect-URI: https://beyond-b2c.auth.us-east-2.amazoncognito.com/oauth2/idpresponse

6. Provisioning:

For the Application the provisioning will be done using Beyond Identity API’s available at https://developer.beyondidentity.com/

7. Beyond IDentity AdMIN CONSOLE COnfig:

Depending upon customer’s SSO please use appropriate SSO Integration guide.

8. BEYOND IDENTITY MFA wITH AWS CONGNITO:

Beyond Identity supports MFA during initial login. AWS COGNITO does not provide ability to configure OIDC or SAML based MFA. AWS Cognito only supports SMS text message, or TOTP as MFA option currently. It is possible for a CIAM App to integrate directly with BI MFA using OIDC or SAML based integration. 

9. Sample flow wITH AWS CONGNITO: