I am using AWS cognito for user authentication in the application that I designed. And where ever there is a need for user audit in the application, I have used the id from cognito as if it is a foreign key from another table(I am using a relational DB). Even though this works, this approach somehow feels improper. Is there any other proper way to design this?
What is the right way to maintain user audit in a system designed to use external authentication?
Viewed 102
1 Answers
In my application, the user logs in with his email address (common scenario). Hence, by construction the email address is a unique identifier both in cognito and in my database.
My database creates a user id for each new user, and that is the main identifier I use in my app (note that this identifier has nothing to do with cognito).
Cognito also assigns an id to each user (which it calls "username"), but I never reference that id (nor have I ever felt the need to reference it). I have been in production for several years, and I have never regretted this decision.
Upside of not linking user ids:
- full flexibility (e.g. I can decide that I want to create a new user Object in my database for a particular cognito user. I can keep the previous user e.g. as a backup, even though it is not linked to the cognito user).
- less work: i don't need to make sure the ids in my system are in line with those in cognito.
Downside of not linking user ids:
- maybe it's faster to query cognito using the username field than the email field? maybe that could be an advantage for some use cases?
Related