Amazon Cognito User Pools Setup

A user pool is a secured user directory that provides sign-in, and sign-up options for your web and mobile application users. Every user, whether they are signed in directly or using a third-party identity provider, has a profile directory that can be accessed with the use of an SDK. User pools are fully managed services that scale to support hundreds of millions of users.

In this tutorial, we will do the following:

• Create and setup user pools.
• Sign up and sign in a user using Cognito UI.

We assume that you have an AWS account. Follow the steps below to complete this tutorial:

Create a User Pool

1. Login to the AWS Management Console and open the AWS Cognito console at https://console.aws.amazon.com/cognito.
2. Choose Manage User Pools.
3. On the User Pools page, choose Create a user pool.
4. On Create a user pool page, enter a name for your user pool and choose Review defaults to save the user pool name.
5. On the Review page, choose Create pool.

Configure App Client

An app client generates a unique App client ID and App clinet sercet which is needed to access the user pool. To configure a user pool app client, do the following:

1. On the left navigation bar, under General Settings, choose App clients.
2. Enter a App client name of your choice.
3. Specify the app's Refresh token expiration. The default value is 30 days. We can change it from 60 minutes to 10 years.
4. Specify the app's Access token expiration. The default value is 60 minutes. We can change it from 60 minutes to 1 day.
5. Specify the app's ID token expiration. The default value is 60 minutes. We can change it from 5 minutes to 1 day.
6. Uncheck Generate client secret.
7. Under Auth Flows Configuration, check Enable username password auth for admin APIs for authentication (ALLOW_ADMIN_USER_PASSWORD_AUTH). Enabling this option will allow sign-up, sign-in of users programatically from our application.
8. Leave other settings as it is and choose Create app client.
9. On the left navigation bar, under App integration, choose App client settings.
10. Select Cognito User Pool as your Enabled Identity Providers.
11. Enter a callback URL where you want your users to be redirected after a successful sign-in.
12. Under Allowed OAuth Flows, select both Authorization code grant and Implicit grant.

Select the checkboxes for all Allowed OAuth Scopes, unless you explicitly want to exclude one.

Refer to the image below for example:


13. Choose Save changes.
14. From the left navigation bar, go to Domain name.
15. Enter a unique domain name of your choice and check for availability.
16. Choose Save changes.
17. From the left navigation bar, go to App integration.

18. Copy Domain to your browser and append /login?response_type=token&client_id=&redirect_uri= parameters to it:

    <https://www.your.domain>/login?response_type=token&client_id=<your client id>&redirect_uri=<https://www.your.redirect.uri>

Example

https://mybuddytest.auth.us-east-1.amazoncognito.com/login?response_type=token&client_id=q022betjclnba7ro0nikokkas&redirect_uri=https://www.example.com

Do not forget to replace the value of client_id and redirect_uri. To get your client Id, go to App clients on the left navigation bar. The value of redirect_uri should be the URL where you want your users to be redirected after a successful login.

19. On hitting enter, you should see the sign-in, sign-up page for your app as shown in the example below:


You can customize this page as per your need from UI customization page.

20. Choose Sign up.
21. Enter your sign up details.
22. Verify your sign up.
23. On successful login, token_id is received in URL. You can use this token to access your resources that is protected by Amazon Cognito.
24. To see the sign up users, go to Users and groups on the left navigation bar.