sage / omniauth-cognito-idp

OmniAuth Strategy for AWS Cognito in Ruby

omniauth-cognito-idp

This is an OmniAuth strategy based on omniauth-oauth2 for authenticating against the Amazon Cognito IdP.

Setup

Cognito User Pool

The User Pool needs to have a domain assigned. You also have to create a client application for the User Pool. The client application should have a secret.

Ruby Application

Add the gem to your bundle as usual. Then, OmniAuth is used as Rack middleware:

# for instance, in config.ru
require 'omniauth-cognito-idp'

use Rack::Session::Cookie # OmniAuth requires session support

use OmniAuth::Strategies::CognitoIdP,
  ENV['CLIENT_ID'],
  ENV['CLIENT_SECRET'],
  client_options: {
    site: ENV['COGNITO_USER_POOL_SITE']
  },
  scope: 'email openid aws.cognito.signin.user.admin profile',
  user_pool_id: ENV['COGNITO_USER_POOL_ID'],
  aws_region: ENV['AWS_REGION']

run MyApplication

The following configuration options are available:

1. client_options (required)

   This is a Hash that is used to configure the OAuth2 client. You have to include the site key and specify the domain you assigned to the Cognito User Pool.

2. scope (required)

   A space separated list of scopes you want to request. Make sure to include openid and some openid attributes if you want to get an ID token (which gives you information about the user without additional request). When you include aws.cognito.signin.user.admin, you can use the access token to get or update the user's attributes in the User Pool.

   See https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html

3. user_pool_id (optional)

   When specified together with aws_region, the ID token returned by Cognito will be verified to really belong to the User Pool you expect.

4. aws_region (optional) When specified together with user_pool_id, the ID token returned by Cognito will be verified to really belong to the given AWS region.

5. jwt_leeway (optional)

   Each JWT has it's own expiration and do not use before dates. As the issuer's clock might be off a bit from your's, you can allow some leeway for the JWT validation. Must be a positive integer. Default is 60 seconds.

Development

The repository contains a small Sinatra application that can be used to test the strategy. Just run rackup with the following ENV variables set:

• COGNITO_CLIENT_ID: The id of the client application
• COGNITO_CLIENT_SECRET: The client application's secret
• COGNITO_POOL_SITE: The domain attached to the user pool.

The application will start at http://localhost:8678. You will have to add a callback URL http://localhost:8678/auth/cognito-idp/callback to the client application in the AWS Console. The test app stores the tokens in memory, so you will need to sign in again after restarting the server.

omniauth-cognito-idp's Issues

`build_access_token` clears all query params

Hello!

First of all - thanks for open-sourcing this gem!

One thing I stumbled upon is this line. It seems that it removes all query params, but I suppose the intention was to only remove the code param?

If that is the case, would it be OK if I submitted a PR which removes just the code param?

For our use-case we need to have other query params preserved.

Offtopic:
Did you plan on adding /userinfo endpoint in this gem, so that the Oauth2 flow is able to retrieve user attributes? Or is that not feasible due dependency on aws-sdk?

Thanks in advance!

Unable to get this to work with Omniauth v2

It looks like Omniauth v2 is quite a big change and it doesnt appear that this works anymore. https://github.com/omniauth/omniauth/wiki/Upgrading-to-2.0

Im trying using the demo application in config.ru and I keep getting CSRF errors.

Sorry that I dont have anything more detailed on this problem.

OmniAuth::Strategies::OAuth2::CallbackError at /auth/cognito-idp/callback
csrf_detected | CSRF detected

file: failure_endpoint.rb location: raise_out! line: 25

Conflict with generic JWT gem on projects for consumption.

lib/omniauth/strategies/cognito_idp.rb:81

Force specify JWT::JWT.decode(

Rename the 'name' to 'cognito_idp' (Use underscore instead of hyphen), easier connect with Rails/Devise

I'm using this gem with devise-omniauthable on Ruby on Rails. It implicitly uses its name option field in rails routing.

I have to configure with like below:

config.omniauth :cognito_idp,
  name: :cognito_idp,
  # other options

I know it's not bad of omniauth-cognito-idp, it's just a compatibility issue. They can also fix this issue.
But it might not cause any problem for Sinatra users, also I believe I achieve benefits for Rails users, please consider this change.

Unable to get id_token when OAuth2 v2.0.6

A nil is returned at the following location.
https://github.com/Sage/omniauth-cognito-idp/blob/v0.1.1/lib/omniauth/strategies/cognito_idp.rb#L76

When I did this, it worked correctly.

      def id_token
        access_token.response.parsed['id_token']
      end