AWS ALB Cognito JWT/OIDC authentication

Question

We are trying to integrate AWS ALB with Cognito user pool. We have setup rules in ALB to authenticate user with Cognito client. After webapp authentication, a session cookie is set. This is all good.

Now, we have a desktop application which does internally connect with Cognito, get access token JWT and manage it (refresh etc.). Now, we are trying to fire http requests to ALB with this access token as Authorization header. ALB redirect these requests to Cognito login page again, instead of validating (and allowing) the JWT present in Auth header.

What we expect is if request contains valid Auth header (JWT), ALB should validate it and allow it. It seems ALB does not check Auth header. How can we achieve this with ALB?
Additionally, is it possible for desktop app to work directly with ALB (instead of Cognito) and use Session ID instead of JWT/Access Token?

Answer

The docs here [https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-flow](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#authentication-flow) (see step #9) show that an authentication session cookie, issued by the ALB, is required to proceed to forwarding of traffic to the Target Group.  The ALB here will actually sign the JWT being sent back to the target group itself, not Cognito in this case.

Depending upon your use case, you may want to use API Gateway to achieve this design rather than ALB.  You could use this [NodeJS JWT authorizer code ](https://github.com/awslabs/aws-jwt-verify) within a custom lambda authorizer instead.  Not sure that's possible with your application but should meet your design expectations of using the Cognito issued JWT.

AWS ALB Cognito JWT/OIDC authentication

Relevant content