passport-oauth2-cognito

Passport strategy for authenticating and fetching profile data from AWS Cognito User pools using OAuth2 and the Amazon SDK

Install

$ npm install passport-oauth2-cognito

Usage

Configure Strategy

The Cognito OAuth 2.0 authentication strategy authenticates requests using the OAuth 2.0 framework and retrieves user data from AWS Cognito User Pools. The strategy requires a verify callback, which accepts these credentials and calls done providing a user, as well as options specifying a consumer key, consumer secret, and callback URL.

const passport = require('passport')
const OAuth2CognitoStrategy = require('passport-oauth2-cognito');

const options = {
  callbackURL: 'https://myapp.com/auth/cognito/callback',
  clientDomain: 'https://myapp.auth.us-west-2.amazoncognito.com',
  clientID: '123-456-789',
  clientSecret: 'shhh-its-a-secret',
  region: 'us-west-2'
};

function verify(accessToken, refreshToken, profile, done) {
  User.findOrCreate(profile, (err, user) => {
    done(err, user);
  });
}

passport.use(new OAuth2CognitoStrategy(options, verify));  
passport.serializeUser((user, done) => done(null, user));
passport.deserializeUser((obj, done) => done(null, obj));

Authenticate Requests

Use passport.authenticate(), specifying the 'oauth2-cognito' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.get('/auth/cognito',
  passport.authenticate('oauth2-cognito')
);
app.get('/auth/cognito/callback',
  passport.authenticate('oauth2-cognito'),
  (req,res) => res.send(req.user)  
);

Cognito configuration

When you create your App Client, you will need to generate an App Client Secret

Your App client settings will need:

Enabled Identity Providers: Cognito User Pool

Callback URL(s): options.callbackURL

Allowed OAuth Flows: Authorization code grant

Allowed OAuth Scopes: [openid, aws.cognito.signin.user.admin, profile]

You must also configure a Domain name for use as options.clientDomain