我应该将cognito用户池与其他社交idps联合，还是通过userpool本身进行社交登录

Question

I am building a social chat application and initially had a cognito user pool that was federated alongside Google/Facebook. I was storing user data based on the user-sub for cognito users and the identity id for google/facebook. Then in my lambda-gql resolvers, I would authenticate via the AWS-sdk:

  AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: process.env.IDENTITY_POOL_ID,
    Logins: {
      [`cognito-idp.us-east-1.amazonaws.com/${
        process.env.COGNITO_USERPOOL_ID
      }`]: Authorization,
    },
  });

Because all users are equal and I don't need fine grained controls over access to aws-resources, it seems like it would be preferable to instead have all authentication handled via the userpool and to get rid of the identity pool entirely.

For example, if I wanted to ban a user's account, it seems that I would first have to lookup the provider based on identity-id and then perform a different action based on the provider.

So my questions are: 1. Is this even possible? - https://github.com/aws-amplify/amplify-js/issues/565 - https://www.reddit.com/r/aws/comments/92ye5s/is_it_possible_to_add_googlefacebook_user_to/

There seems to be a lot of confusion, and the aws docs are less clear than usual (which isn't much imo). https://docs.aws.amazon.com/cognito/latest/developerguide/authentication.html

It seems that there is clearly a method to do this. I followed the above guide and am getting errors with the hosted UI endpoint, but that's probably on me ( https://forums.aws.amazon.com/thread.jspa?threadID=262736 ). However, I do not want the hosted UI endpoint, I would like cognito users to sign in through my custom form and then social sign in users to click a "continue with fb" button and have that automatically populate my userpool.

Then replace the code above with the following to validate all users:

const validate = token => new Promise(async (resolve) => {
  const {
    data: { keys },
  } = await axios(url);

  const { sub, ...res } = decode(token, { complete: true });
  const { kid } = decode(token, { header: true });
  const jwk = R.find(R.propEq('kid', kid))(keys);
  const pem = jwkToPem(jwk);
  const response = res && res['cognito:username']
    ? { sub, user: res['cognito:username'] }
    : { sub };
  try {
    await verify(token, pem);
    resolve(response);
  } catch (error) {
    resolve(false);
  }
});

2. If it is possible, what is the correct mechanism that would replace the following:

      Auth.federatedSignIn('facebook', { token: accessToken, expires_at }, user)
        .then(credentials => Auth.currentAuthenticatedUser())
        .then((user) => {
          onStateChange('signedIn', {});
        })
        .catch((e) => {
          console.log(e);
        });

From what I have seen, there does not appear to be a method with Amplify to accomplish this. Is there some way to do this with the aws-sdk? What about mapping the callback from the facebook api to create a cognito user client-side? It seems like that could get quite messy.

3. If there is no mechanism to accomplish the above, should I federate cognito users with social sign ins?

4. And then what should I use to identify users in my database? Am currently using username and sub for cognito and identity id for federated users. Extracting the sub from the Auth token server-side and then on the client:

  Auth.currentSession()
    .then((data) => {
      const userSub = R.path(['accessToken', 'payload', 'sub'], data);
      resolve(userSub);
    })
    .catch(async () => {
      try {
        const result = await Auth.currentCredentials();
        const credentials = Auth.essentialCredentials(result);
        resolve(removeRegionFromId(credentials.identityId));
      } catch (error) {
        resolve(false);
      }
    });

If anyone could provide the detailed authoritative answer I have yet to find concerning the use of cognito user pools in place of federating that would be great. Otherwise a general outline of the correct approach to take would be much appreciated.

Answer 1

Here's what I ended up doing for anyone in a similar position, this isn't comprehensive:

1. Create a userpool, do not specify client secret or any required attributes that could conflict with whats returned from Facebook/Google.
2. Under domains, in the Cognito sidebar, add what ever you want yours to be.
3. The add your identity provided from Cognito, for FB you want them to be comma seperated like so: openid, phone, email, profile, aws.cognito.signin.user.admin
4. Enable FB from app client settings, select implicit grant. I belive, but am not positive, openid is required for generating a access key and signin.user.admin for getting a RS256 token to verify with the public key.
5. The from FB dev console, https://yourdomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse , as valid oauth redirects.
6. Then, still on FB, go to settings (general not app specific), and enter https://yourdomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse
7. https://yourdomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse for your site url.
8. Then for the login in button you can add the following code,

const authenticate = callbackFn => () => {
  const domain = process.env.COGNITO_APP_DOMAIN;
  const clientId = process.env.COGNITO_USERPOOL_CLIENT_ID;
  const type = 'token';
  const scope = 'openid phone email profile aws.cognito.signin.user.admin';
  const verification = generateVerification();
  const provider = 'Facebook';
  const callback = `${window.location.protocol}//${
    window.location.host
  }/callback`;

  const url = `${domain}/authorize?identity_provider=${provider}&response_type=${type}&client_id=${clientId}&redirect_uri=${callback}&state=${verification}&scope=${scope}`;
  window.open(url, '_self');
};

9. Then on your redirect page:

  useEffect(() => {
    // eslint-disable-next-line no-undef
    if (window.location.href.includes('#access_token')) {
      const callback = () => history.push('/');
      newAuthUser(callback);
    }
  }, []);

/* eslint-disable no-undef */
import { CognitoAuth } from 'amazon-cognito-auth-js';
import setToast from './setToast';

export default (callback) => {
  const AppWebDomain = process.env.COGNITO_APP_DOMAIN;
  // https://yourdomainhere.auth.us-east-1.amazoncognito.com'
  const TokenScopesArray = [
    'phone',
    'email',
    'profile',
    'openid',
    'aws.cognito.signin.user.admin',
  ];
  const redirect = 'http://localhost:8080/auth';
  const authData = {
    ClientId: process.env.COGNITO_USERPOOL_CLIENT_ID,
    AppWebDomain,
    TokenScopesArray,
    RedirectUriSignIn: redirect,
    RedirectUriSignOut: redirect,
    IdentityProvider: 'Facebook',
    UserPoolId: process.env.COGNITO_USERPOOL_ID,
    AdvancedSecurityDataCollectionFlag: true,
  };
  const auth = new CognitoAuth(authData);

  auth.userhandler = {
    onSuccess() {
      setToast('logged-in');
      callback();
    },
    onFailure(error) {
      setToast('auth-error', error);
      callback();
    },
  };

  const curUrl = window.location.href;
  auth.parseCognitoWebResponse(curUrl);
};

You can then use Auth.currentSession() to get user attributes from the client.

10. Then server-side you can validate all user like so:

const decode = require('jwt-decode');
const jwt = require('jsonwebtoken');
const jwkToPem = require('jwk-to-pem');
const axios = require('axios');
const R = require('ramda');
const logger = require('./logger');

const url = `https://cognito-idp.us-east-1.amazonaws.com/${
  process.env.COGNITO_USERPOOL_ID
}/.well-known/jwks.json`;

const verify = (token, n) => new Promise((resolve, reject) => {
  jwt.verify(token, n, { algorithms: ['RS256'] }, (err, decoded) => {
    if (err) {
      reject(new Error('invalid_token', err));
    } else {
      resolve(decoded);
    }
  });
});

const validate = token => new Promise(async (resolve) => {
  const {
    data: { keys },
  } = await axios(url);

  const { sub, ...res } = decode(token, { complete: true });
  const { kid } = decode(token, { header: true });
  const jwk = R.find(R.propEq('kid', kid))(keys);
  const pem = jwkToPem(jwk);
  const response = res && res['cognito:username']
    ? { sub, user: res['cognito:username'] }
    : { sub };
  try {
    await verify(token, pem);

    resolve(response);
  } catch (error) {
    logger['on-failure']('CHECK_CREDENTIALS', error);
    resolve(false);
  }
});

const checkCredentialsCognito = Authorization => validate(Authorization);