- Newest
- Most votes
- Most comments
Yes, there is a way to take users directly to the SignUp version of the Cognito Managed Login UI, but it's not done through the 'screen_hint' parameter as suggested.
To direct users to the SignUp page of the Managed Login UI, you need to use the '/signup' endpoint instead of the standard '/login' endpoint. This can typically be achieved by modifying the URL you use for signInWithRedirect.
Instead of using the standard login URL, which might look something like:
https://your-domain.auth.region.amazoncognito.com/login
You would use:
https://your-domain.auth.region.amazoncognito.com/signup
This '/signup' endpoint is specifically designed to present the sign-up page to users, allowing them to create a new account directly without first seeing the sign-in page.
When implementing this in your React app, you'll need to modify the URL used in your signInWithRedirect call to include the '/signup' path instead of '/login'. The exact implementation will depend on how you're currently handling authentication in your app.
Remember that the '/signup' endpoint accepts the same parameters as the '/oauth2/authorize' endpoint, so you can include additional parameters as needed for your authentication flow.
It's worth noting that while this method will take users directly to the sign-up page, the overall look and feel will still be consistent with the rest of your Managed Login UI, maintaining a cohesive user experience.
If you're having trouble implementing this or it's not working as expected, you may want to double-check your Cognito user pool and app client settings to ensure that user sign-ups are enabled and properly configured.
Sources
User-interactive managed login and classic hosted UI endpoints - Amazon Cognito
User pool managed login - Amazon Cognito
Here is how you do it in Next.js using NextAuth v5.
// auth.ts
export const {handlers, auth} = NextAuth({
...
providers: [
Cognito({
id: "cognito",
name: "Cognito Sign-In",
checks: ["nonce"]
}),
Cognito({
id: "cognito-signup",
name: "Cognito Sign-Up",
checks: ["nonce"],
authorization: {
url: `${COGNITO_DOMAIN}/signup`,
}
})
],
...
Then you can use these two functions from next-auth:
signIn("cognito-signup") -> this goes to the sign-up page
signIn("cognito") -> this goes to the log-in page
Note: the above assumes you have configured NextAuth v5 with the correct env vars.
answered a year ago
This is a limitation of the redirect and authorization endpoint from Cognito.
The /oauth2/authorize endpoint is a redirection endpoint that supports two redirect destinations. If you include an identity_provider or idp_identifier parameter in the URL, it silently redirects your user to the sign-in page for that identity provider (IdP). Otherwise, it redirects to the Login endpoint with the same URL parameters that you included in your request.
That means that if you want to create a UX that goes directly to the SignUp endpoint (list of endpoints) you need to bypass the redirect and authorization endpoint (Direct link is the only viable way to access the endpoint)
Inspired by Kappacake, I've managed to make it work by defining separate CognitoProvider for SignIn and SignUp (next-auth@4.24.11)
export const authOptions: NextAuthOptions = { ... providers: [ // sign-in UX CognitoProvider({ id: 'cognito', clientId: cognitoClientId, clientSecret: cognitoClientSecret, issuer: cognitoIssuer, }), // sign-up UX CognitoProvider({ id: 'cognito-signup', clientId: cognitoClientId, clientSecret: cognitoClientSecret, wellKnown: undefined, // important otherwise the new authorization endpoint is ignored authorization: `${cognitoDomain}/signup?client_id=${cognitoClientId}&response_type=code&redirect_uri=${redirectUri}`, }) ], ...
Then you call it this way
signIn('cognito', { callbackUrl: '/your/return/url/after/cognito/authentication' } ) signIn('cognito-signup', { callbackUrl: '/your/return/url/after/cognito/authentication' } )
This way, NextAuth manages the state and keeps the communication safe, while bypassing /oauth2/authorize.
PS: Notice that screen_hint=signup parameter is not part of the OpenId Connect standard, while it's convenient, it's used by another proprietary identity provider called Auth0 to separate the Login and SignUp experiences.
Posted answer in Stack Overflow
answered a year ago
