Integrate OpenPass with Amazon Cognito

The OpenPass authentication service is based on the OpenID Connect (OIDC) standard, which allows its authentication service to integrate with other services that support OIDC-identity providers.

IMPORTANT: Make sure you have registered for an AWS account first.

Here are the steps you need to complete to integrate OpenPass with Cognito.

  1. To handle authentication requests coming from the Amazon Cognito user pool, register AWS integration with OpenPass. Take note of the client ID and secret values.
  2. To add a federated identity provider in Cognito, add a new identity provider with the OIDC type to the Cognito user pool.
  3. To test the integration, check the hosted UI for the application in Cognito.

The following sections provide more details for each step.

NOTE: The following instructions that rely on third-party UI are current as of February 27, 2024.

1. Register AWS integration with OpenPass

To create and register the application, complete the OpenPass Registration Request form. Here are notes for answering some of the questions.

Field Notes
Client Name The name of the application you are integrating. This will refer to the application you are deploying in Cognito.
Disable PKCE PKCE must be disabled for this registration.
Logo A link to the logo for your application.
Friendly Website URL The URL for the application you have registered in Cognito.
Redirect URLs This needs to be the URLs where OpenPass will return the results of the authentication. They are specific to the Amazon Cognito user pool that it is being integrated with.
The URLs must be formatted as: https://<cognito domain>/oauth2/idpresponse.
You can find the URLs in the Cognito domain field on the App Integration tab of your Cognito user-pool page.
Link to your Terms of Service This is the link to your application's terms of service. OpenPass recommends sharing it to provide users with transparent information about the usage of your service.
Link to your privacy statement This is the link to the privacy and policy terms of the application. OpenPass recommends sharing the privacy policy URI with users to explain how their data will be handled.

This completes the OpenPass registration.

IMPORTANT: After registration, take note of the client ID and secret values. You will need them to add the OIDC identity provider in Cognito.

2. Create a user pool and add federated identity provider

If a user pool hasn’t already been created, follow the instructions in Getting started with user pools. Be sure to select Federated Identity Providers and enter the following information.

Field Instructions
Federated Sign-In Options Select OpenID Connect (OIDC) as the identity provider.
Client ID This is the ID that corresponds to the application registration entry created in the OpenPass service.
Client Secret This corresponds to the client secret of the application registration entry created in the OpenPass service.
Authorized Scopes Enter openid. As of now, this is the only scope OpenPass supports.
Issuer URL Enter https://auth.myopenpass.com.

If you already have a user pool, go to its configuration page and click the Sign-In Experience tab. Then click Add Identity Provider and enter the information from the previous table there.

This completes the creation and/or configuration of the user pool.

3. Test the integration

Test the integration by checking the hosted UI for the application in Cognito. Use the following instructions.

Step Description
1 In Cognito, go to User pools > <your user pool> > App integrations.
2 At the bottom of the page, select the application you want to test.
3 Click the app client name.
4 In the Hosted UI section, click View Hosted UI.

A new tab opens with the UI for testing login authentication. This completes your integration with Cognito.

Additional resources

For more information, see the following pages: