Cognito add Custom Claims to Tokens

Question

I'm working with Cognito and I have a role-based authorization flow in my backend application. I would like to add the role of a customer to the token, so that I can easily manage the guards of the API endpoints. I found out Cognito doesn't provide such a customization out of the box, and the suggestion is to use a Lambda function that will do the trick. I spinned up a Lambda and I'm sending the role I want to include in the token (by updating userAttributes, which is weird because I can only do it after user is authenticated) but it doesn't seem to do the trick. Is there a way to achieve such a thing? If so, how can I do it? Thanks in advance!

Answer

I believe what you are trying to do is trigger the lambda function before the user is authenticated, which requires a pre-authentication trigger.  In your Lambda function, you can update the user attributes before the token is generated. Use the event.request.userAttributes parameter to access the user attributes. Update the cognito:groups attribute with the desired role value. I’ve included a link that describes the pre-authentication triggers, as well as the documentation for user-identity-pool integration with lambda triggers.

Pre Authenitcation
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-authentication.html
Lambda Triggers & Identity Pools
_https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html_ (https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html)

Hope this helps!

Cognito add Custom Claims to Tokens

相關內容