Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

What's the Best Practice for External IdP and Existing Account Linking?

0

Currently, I have a Cognito user pool set up with Social sign-on, not using hosted ui. In my PreSignUp lambda, if it detects an existing user in the pool, it links the two accounts automatically via AdminLinkProviderForUser.

I am wondering: is this is an anti-pattern, to automatically link the two accounts? Do I need to explicitly get consent from the user if an existing account is found to link them together? Should they have to sign in with email/password to link the two if the account already exists? If so, is there a recommended way to direct the user around to maintain the external sign-in state?

Topics
Security, Identity, & ComplianceAWS Well-Architected Framework
Tags
Amazon CognitoAWS Identity and Access ManagementSecurity
Language
English

asked 9 months ago249 views

1 Answer
0
Accepted Answer

Worth to take a look at this:

AWS provides the AdminLinkProviderForUser API for linking external IdPs to Cognito users, and best practice is to require explicit user consent and re authentication before linking. Automatic linking in PreSignUp is discouraged because it can introduce security risks:

https://repost.aws/knowledge-center/cognito-external-federation-linking

https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html

EXPERT

answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content