The AWS connector signs users in against an Amazon Cognito user pool. It is the bridge you want when an existing product already stores its users in Cognito and you are moving the front door to Authdog without migrating the directory on day one.
Copy the redirect URI
In the Authdog console, select the project and environment, open Authentication > Providers, find AWS, and click Enable. Copy the redirect URI shown in the form:
https://identity.authdog.com/api/v1/callback/<connectionId>Create the app client
- Open the Amazon Cognito console and select the user pool.
- Under App integration, note the Cognito domain — that is the Domain URI Authdog needs.
- Create an App client of type confidential client, so it is issued a client secret.
- Under Hosted UI settings, add Authdog's redirect URI as an Allowed callback URL.
- Enable the Authorization code grant flow.
- Select the OpenID Connect scopes
openid,email,phone, andprofile. - Save, then copy the Client ID and Client secret.
Configure Authdog
| Field | Value |
|---|---|
| Client ID | The client identifier from the provider |
| Client Secret | The client secret from the provider |
| Domain URI | Your user pool domain, e.g. https://acme.auth.us-east-2.amazoncognito.com |
Save, then toggle the connection active.
What AWS Cognito returns
Authdog requests the openid email phone aws.cognito.signin.user.admin profile scopes and reads the profile from the ID token the provider issues.
Profile claims come from the ID token Cognito issues — sub, email and its verified flag, and any custom attributes you mapped into the token.
The aws.cognito.signin.user.admin scope is part of the request, so the pool must allow it on the app client. If your pool does not expose it, sign-in fails at the authorize step rather than the exchange.
Test it
- Open your environment's hosted sign-in page, or link to
https://identity.authdog.com/api/v1/signin/<connectionId>. - Select the AWS Cognito button and complete the flow.
- Confirm the user appears under Users in the console with a AWS Cognito identity linked.
Troubleshooting
| Symptom | Cause |
|---|---|
invalid_client |
The app client was created as a public client with no secret |
invalid_scope |
The app client does not have all the requested scopes enabled |
| Domain not found | The Cognito domain is missing, or the region in the host is wrong |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own connectionId, and so its own redirect URI to register |
Related
| Read | To learn how to |
|---|---|
| Connectors | Set up any other social provider |
| Enterprise SSO | Connect a workforce IdP instead of a user pool |