Link a third party application account in Cognito

user_4672897 0
Viewed 535

I need to link a third party application credentials to the one the user uses to connect to my application through Cognito. In other words: user connects to application A (my application), then application A asks user for credentials to connect to application B. Application A then interact with application B with the credentials provided by the user. I would like to link those identities but let the user connect to application A only with credentials I provided him (and not from the ones he uses for B).

AWS has AdminLinkProviderForUser in Cognito which doesn't satisfy the last requirement.

Application B offers multiple authentications: Form, Basic HTTP, SSO, OAuth2 and OpenID.

Is there any way to link the two identities in the way described above and store it in Cognito for future use?

amazon-cognito oauth-2.0 node.js authentication
1 Answers

If I am understanding you correctly - what you need is for the user to log into your application with credentials they have for another application and then store the login they have for that application and provide them with new login details where those login details link them to your application and the that application.

Have a look here: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html

However taking that approach the users will still login with application B details. But Cognito provides that out of the box.

If for some reason you do not want to take that approach - and you want to have a force change on the password you must do the link yourself.

A suggested approach would be as follows (Making use of Lambda Triggers in Cognito User Pools):

Pre-signup lambda trigger:

Now you have the user stored with the auth data from application B as a custom attribute.

This is not the best way to do it though because auth data usually needs to get refreshed which will add extra complexity. You could do that refresh in a Pre-Authentication Trigger that updates that custom attribute for the user.

Honestly, if application B is custom, I think the best approach for you will be to use OIDC Provider approach https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-oidc-idp.html

user_56979920
Related