AWS cognito: Restructure social IdP page into per-provider subpages
Summary
The monolithic 'Social identity providers' page is rewritten and split: the long inline registration walkthroughs for Facebook, Login with Amazon, Google, and Sign in with Apple, plus the console configuration and testing sections, are removed and replaced with a short overview and links to new per-provider pages (cognito-user-pools-social-idp-google/apple/facebook/lwa.html). The intro is reworded to describe managed login and token handling.
Security assessment
This is a documentation reorganization: provider-specific setup steps (including the removed note to 'Securely store the values the Google displays under Your client ID and Your client secret') are moved to dedicated pages rather than newly added or fixed. No vulnerability, CVE, credential-handling change, or new security control is introduced by this diff, so it is a low-severity editorial change.
Evidence
+Each provider has its own developer console, its own values to enter, and its own pitfalls. Choose your provider for step-by-step instructions:
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-social-idp.md b/cognito/latest/developerguide/cognito-user-pools-social-idp.md index f72735a..b72c1d9 100644 --- a//cognito/latest/developerguide/cognito-user-pools-social-idp.md +++ b//cognito/latest/developerguide/cognito-user-pools-social-idp.md @@ -7,2 +6,0 @@ -Set up a developer appConfigure your user poolTest social sign-in - @@ -11,139 +9 @@ Set up a developer appConfigure your user poolTest social sign-in -Your web and mobile app users can sign in through social identity providers (IdP) like Facebook, Google, Amazon, and Apple. With the built-in hosted web UI, Amazon Cognito provides token handling and management for all authenticated users. This way, your backend systems can standardize on one set of user pool tokens. You must enable managed login to integrate with supported social identity providers. When Amazon Cognito builds your managed login pages, it creates OAuth 2.0 endpoints that Amazon Cognito and your OIDC and social IdPs use to exchange information. For more information, see the [Amazon Cognito user pools Auth API reference](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html). - -You can add a social IdP in the AWS Management Console, or you can use the AWS CLI or Amazon Cognito API. - -###### Note - -Sign-in through a third party (federation) is available in Amazon Cognito user pools. This feature is independent of federation through Amazon Cognito identity pools (federated identities). - -###### Topics - - * Set up a social IdP developer account and application - - * Configure your user pool with a social IdP - - * Test your social IdP configuration - - - - -## Set up a social IdP developer account and application - -Before you create a social IdP with Amazon Cognito, you must register your application with the social IdP to receive a client ID and client secret. - -Facebook - - -For the latest information about configuration of Meta developer accounts and authentication, see [Meta App Development](https://developers.facebook.com/docs/development). - -###### How to register an application with Facebook/Meta - - 1. Create a [developer account with Facebook](https://developers.facebook.com/docs/facebook-login). - - 2. [Sign in](https://developers.facebook.com/) with your Facebook credentials. - - 3. From the **My Apps** menu, choose **Create New App**. - - 4. Enter a name for your Facebook app, and then choose **Create App ID**. - - 5. On the left navigation bar, choose **Settings** , and then **Basic**. - - 6. Note the **App ID** and the **App Secret**. You will use them in the next section. - - 7. Choose **\+ Add Platform** from the bottom of the page. - - 8. Choose **Website**. - - 9. Under **Website** , enter the path to the sign-in page for your app into **Site URL**. - - https://mydomain.auth.us-east-1.amazoncognito.com/login?response_type=code&client_id=1example23456789&redirect_uri=https://www.example.com - - - 10. Choose **Save changes**. - - 11. Enter the path to the root of your user pool domain into **App Domains**. - - https://mydomain.auth.us-east-1.amazoncognito.com - - 12. Choose **Save changes**. - - 13. From the navigation bar choose **Add Product** and choose **Set up** for the **Facebook Login** product. - - 14. From the navigation bar choose **Facebook Login** and then **Settings**. - -Enter the path to the `/oauth2/idpresponse` endpoint for your user pool domain into **Valid OAuth Redirect URIs**. - - https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse - - - 15. Choose **Save changes**. - - - - -Login with Amazon - - -For the latest information about configuration of Login with Amazon developer accounts and authentication, see [Login with Amazon Documentation](https://developer.amazon.com/docs/login-with-amazon/documentation-overview.html). - -###### How to register an application with Login with Amazon - - 1. Create a [developer account with Amazon](https://developer.amazon.com/login-with-amazon). - - 2. [Sign in](https://developer.amazon.com/lwa/sp/overview.html) with your Amazon credentials. - - 3. You need to create an Amazon security profile to receive the Amazon client ID and client secret. - -Choose **Apps and Services** from navigation bar at the top of the page and then choose **Login with Amazon**. - - 4. Choose **Create a Security Profile**. - - 5. Enter a **Security Profile Name** , a **Security Profile Description** , and a **Consent Privacy Notice URL**. - - 6. Choose **Save**. - - 7. Choose **Client ID** and **Client Secret** to show the client ID and secret. You will use them in the next section. - - 8. Hover over the gear icon and choose **Web Settings** , and then choose **Edit**. - - 9. Enter your user pool domain into **Allowed Origins**. - - https://mydomain.auth.us-east-1.amazoncognito.com - - 10. Enter your user pool domain with the `/oauth2/idpresponse` endpoint into **Allowed Return URLs**. - - https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse - - 11. Choose **Save**. - - - - -Google - - -For more information about OAuth 2.0 in the Google Cloud platform, see [Learn about authentication & authorization](https://developers.google.com/workspace/guides/auth-overview) in the Google Workspace for Developers documentation. - -###### How to register an application with Google - - 1. Create a [developer account with Google](https://developers.google.com/identity). - - 2. Sign in to the [Google Cloud Platform console](https://console.cloud.google.com/home/dashboard). - - 3. From the top navigation bar, choose **Select a project**. If you already have a project in the Google platform, this menu displays your default project instead. - - 4. Select **NEW PROJECT**. - - 5. Enter a name for your product and then choose **CREATE**. - - 6. On the left navigation bar, choose **APIs and Services** , then **Oauth consent screen**. - - 7. Enter App information, an **App domain** , **Authorized domains** , and **Developer contact information**. Your **Authorized domains** must include `amazoncognito.com` and the root of your custom domain, for example `example.com`. Choose **SAVE AND CONTINUE**. - - 8. 1\. Under **Scopes** , choose **Add or remove scopes** , and choose, at minimum, the following OAuth scopes. - - 1. `.../auth/userinfo.email` - - 2. `.../auth/userinfo.profile` - - 3. openid +Your web and mobile app users can sign in through social identity providers (IdP) like Google, Facebook, Amazon, and Apple. You enable managed login, and Amazon Cognito adds a sign-in button for each social IdP to your managed login pages. Amazon Cognito handles the OAuth 2.0 and OpenID Connect exchanges with the provider and issues your app one standard set of user pool tokens, so your backend systems can standardize on user pool tokens regardless of how the user signed in. For more information about the endpoints that Amazon Cognito creates for these exchanges, see the [Amazon Cognito user pools Auth API reference](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html). @@ -151 +11 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 9. Under **Test users** , choose **Add users**. Enter your email address and any other authorized test users, then choose **SAVE AND CONTINUE**. +Each provider has its own developer console, its own values to enter, and its own pitfalls. Choose your provider for step-by-step instructions: @@ -153 +13 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 10. Expand the left navigation bar again, and choose **APIs and Services** , then **Credentials**. + * [Add Google as a social identity provider](./cognito-user-pools-social-idp-google.html) @@ -155 +15 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 11. Choose **CREATE CREDENTIALS** , then **OAuth client ID**. + * [Add Sign in with Apple as a social identity provider](./cognito-user-pools-social-idp-apple.html) @@ -157 +17 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 12. Choose an **Application type** and give your client a **Name**. + * [Add Facebook as a social identity provider](./cognito-user-pools-social-idp-facebook.html) @@ -159 +19 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 13. Under **Authorized JavaScript origins** , choose **ADD URI**. Enter your user pool domain. + * [Add Login with Amazon as a social identity provider](./cognito-user-pools-social-idp-lwa.html) @@ -161 +20,0 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - https://mydomain.auth.us-east-1.amazoncognito.com @@ -163 +21,0 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 14. Under **Authorized redirect URIs** , choose **ADD URI**. Enter the path to the `/oauth2/idpresponse` endpoint of your user pool domain. @@ -165 +22,0 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/idpresponse @@ -167,148 +24 @@ For more information about OAuth 2.0 in the Google Cloud platform, see [Learn ab - 15. Choose **CREATE**. - - 16. Securely store the values the Google displays under **Your client ID** and **Your client secret**. Provide these values to Amazon Cognito when you add a Google IdP. - - - - -Sign in with Apple - - -For the most up-to-date information about setting up Sign in with Apple, see [Configuring Your Environment for Sign in with Apple](https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple) in the Apple Developer documentation. - -###### How to register an application with Sign in with Apple (SIWA) - - 1. Create a [developer account with Apple](https://developer.apple.com/programs/enroll/). - - 2. [Sign in](https://developer.apple.com/account/#/welcome) with your Apple credentials. - - 3. On the left navigation bar, choose **Certificates, Identifiers & Profiles**. - - 4. On the left navigation bar, choose **Identifiers**. - - 5. On the **Identifiers** page, choose the **+** icon. - - 6. On the **Register a New Identifier** page, choose **App IDs** , and then choose **Continue**. - - 7. On the **Select a type** page, choose **App** , then choose **Continue**. - - 8. On the **Register an App ID** page, do the following: -