Ensuring Cognito (Authoriser) issues both ID and ACCESS tokens, against authcode from 3rd Party Identity Provider in a Federated Identities set-up

Question

Goal: We want to authenticate both devices and users in Keycloak(as Identity Provider and Authenticator), then have Keycloak issue an authcode, which Cognito then swaps for a Cognito ID Token and Access Token, issued to the user or device or client.
Concern: We wish to also use scopes and claims encoded in the tokens(issued by Cognito) to perform validations for role- or resource- or attribute- based access control and we are not sure if there are challenges with Cognito issues ID tokens that contain such information for us to use during validations.
Ask: Ideally, we would like Keycloak to do authentication, Cognito to issues tokens that contain attributes that are app-logic specific. Can we do this? How? What alternatives exist to achieve the same outcome?

Vardan Matevosyan · Answer

Please have a look into this blog post about Cognito token customization features that might help with third-party authenticators like Keycloak.
https://aws.amazon.com/blogs/security/how-to-customize-access-tokens-in-amazon-cognito-user-pools/

**Implementation Approach**

**Pre-Token Generation Flow**
* Keycloak handles the initial authentication
* Cognito receives the authentication response
* The pre-token generation Lambda trigger can then customize the Cognito-issued tokens

**Token Customization Capabilities**
* Add application-specific claims to access tokens
* Refine scope claims for access control
* Include custom attributes for authorization decisions

Needs to be tested to be sure, but flow seems viable. 
Hope this helps. 
Thanks!

Ensuring Cognito (Authoriser) issues both ID and ACCESS tokens, against authcode from 3rd Party Identity Provider in a Federated Identities set-up

Add your answer

Relevant content