How do I set up Auth0 as an OIDC provider in an Amazon Cognito user pool?

Short description

Amazon Cognito user pools allow signing in with third-party OpenID Connect identity providers (OIDC) such as Salesforce or Ping Identity. To set up Auth0 as an OIDC provider, you need an Amazon Cognito user pool with an app client and domain name, and an Auth0 account with an Auth0 application.

Resolution

Follow these steps to create or configure the:

• Auth0 account
• Auth0 application
• OIDC settings
• app client settings

If you haven't already done so, create an Amazon Cognito user pool with a user, an app client, and a domain name.

Create Auth0 account

If you already have an Auth0 account, then sign in. To create an Auth0 account, follow the instructions in the Auth0 Get Started documentation.

Create Auth0 application

1. From the Auth0 website, choose the Dashboard.
2. In the navigation pane, expand Applications on the left pane, and then click Create Application.
3. In the dialog box, enter name for the application. Fox example, App1.
4. Under Choose an application type choose Single Webpage Applications.
5. Choose Create.

Note the Client ID, Client Secret, and Domain from the application settings tab of the Auth0 application.

In the Allowed Callback URLs section, be sure to add the Amazon Cognito callback domain for the user pool. The domain format is similar to this:
https://<cognito-domain>.auth.<region>.amazoncognito.com/oauth2/idpresponse.

Configure OIDC settings for user pool

1. Open the Amazon Cognito console, and then choose Manage User Pools.
2. Choose your user pool, and then in the navigation pane, choose Identity providers.
3. Choose OpenID Connect.
4. Enter the Client ID and Client secret from the Auth0 application.
5. Select the Attributes request method dropdown list, and then choose GET.
6. For Authorization scope, enter phone email openid profile.
7. For Issuer, add the domain name from the Auth0 console. For example: https://example.auth0.com.
8. Choose Create provider, and then choose Run discovery.
9. Choose Create.
10. In the navigation pane, choose Attribute mapping.
11. Create an attribute mapping for email in the OIDC attribute section. The OIDC attribute email maps to the user pool attribute email.

Configure app client settings for user pool

1. Open the Amazon Cognito console, and then choose App client settings.
2. In Enabled identity providers, select the Auth0 and Cognito User Pool check boxes.
3. For Callback URLs, enter a URL.
4. For Sign out URL, enter a URL where the users are redirected to after signing out.
5. For Allowed OAuth Flows, be sure to select at least the Implicit grant check box.
6. For Allowed OAuth Scopes, be sure to select at least the email and openid check boxes.
7. Choose Save changes.

Testing the setup

1. Open the Amazon Cognito console, and choose Manage User Pools.
2. In the navigation pane, choose App client settings.
3. Select your app client, and then choose Launch Hosted UI.
4. On the Hosted UI page, choose Auth0, and then log into the Auth0 login page.
5. The page redirects to the callback URL specified in the app client settings.
6. (Optional) You can check the Auth0 user created in the users and groups settings in the user pool.

---

Related information

Adding OIDC identity providers to a user pool