The Cognito Connector provides a way for Maverics to interact with Amazon Cognito via OIDC. The Connector automatically fetches the information from oidcWellKnownURL and uses the provided API endpoints to authenticate users and perform session validation.
By default, the Cognito connector follows the Authorization Code Flow with Proof Key for Code Exchange (PKCE). If the OIDC provider does not support PKCE, set the disablePKCE option to true.
Configuration options
The following values can be provided to the OIDC Connector via the Maverics configuration file.
OAuth Client ID
oauthClientID is the client ID of the Maverics application registered in the OIDC provider organization.
OAuth Client Secret
oauthClientSecret is the client secret used to register the Maverics application in the OIDC provider.
OAuth Login Redirect
oauthLoginRedirect is used to define login redirect callback URLs.
It defines the urls that the OIDC provider will use to redirect the client back to after authentication. The urls must be absolute URLs and match exactly with one of the registered URLs on the provider. If no matches are found during the auth flow, the first URL from the urls list will be used.
The orchestrator will serve the callback handlers on all URLs specified in the urls field under this section.
The
urlspaths should not conflict with the path of any application resources. The path can be arbitrary (e.g./maverics-oidcor/oidc-handler).
OIDC Well-known URL
oidcWellKnownURL is the URL that returns OpenID Connect metadata about the OIDC provider authorization server.
OAuth Logout Redirect
oauthLogoutRedirect is used to define urls that an OIDC provider will use to redirect the client back to the application after logging out the user.
The urls must be absolute URLs and match exactly with one of the registered URLs on the provider. If no matches are found during the logout flow, the first URL from the urls list will be used.
The orchestrator will serve the callback handlers on all URLs specified in the urls field under this section.
The
urlspaths should not conflict with the path of any application resources. The path can be arbitrary (e.g./oidc-logoutor/logout-handler).
Disable PKCE
disablePKCE is disable the Proof Key for Code Exchange (PKCE) extension (enabled by default).
Health Check
healthCheck defines an optional health check for the connector. This option is required when using the connector in an IDP-continuity scenario. For more info on how to define the health check, please see the docs.
Examples
Basic Cognito Connector Configuration
connectors:
- name: MyCognito
type: cognito
oidcWellKnownURL: https://cognito-idp.us-west-1.amazonaws.com/us-west-1_xxxx/.well-known/openid-configuration
oauthClientID: exampleID
oauthClientSecret: <exampleSecret>
oauthLoginRedirect:
urls:
- https://host1.example.com/oidc
- https://host2.example.com/oidc
oauthLogoutRedirect:
urls:
- https://host1.example.com/logout
- https://host2.example.com/logout
disablePKCE: false