Here are step-by-step directions for configuring Cognito as an identity provider in ConsoleMe:

  1. Sign in to AWS, visit Cognito, and create a new User Pool

  1. Under App Clients, click "Add an app client"

  2. We've selected ALLOW_USER_PASSWORD_AUTH, and left the other settings as defaults

  1. Click "Review", give your pool a name if you haven't already, and click "Create Pool".

  2. Go back to "App Integration" -> "App Client Settings", enable "Cognito Identity Pool" as a valid Identity Provider, and configure the following urls under callback urls:

http://localhost:8081/auth, http://localhost:8081/oauth2/idpresponse,http://localhost:3000/auth, http://localhost:3000/oauth2/idpresponse

  1. Under Allowed OAuth flows, select Authorization code grant

  2. Under Allowed OAuth Scopes , select email, openid, and profile.

  3. Create a test user and test group under Users and Groups.

  4. Change other settings as needed to satisfy your security and authorization needs.

  5. Make a ConsoleMe configuration. You can do this by copying example_config/example_config_oidc_cognito_all_in_one.yaml to a directory of your choice and changing the various values in that file to suit your needs. The key values to change are:

  • oidc_secrets.client_id = Client ID in Cognito (App Clients -> App Client ID)

  • oidc_secrets.secret = Client Secret in Cognito (App Clients -> App Client Secret)

  • oidc_secrets.client_scope = List of Scopes granted to the App integration in Cognito. Usually email and openid,

  • get_user_by_oidc_settings.jwt_groups_key = 'cognito:groups`

  • get_user_by_oidc_settings.metadata_url = The metadata URL of your Cognito Pool. Usually this is the following (Replace {user_pool_id} with your own pool ID):

  • get_user_by_oidc_settings.access_token_audience = This must be set to null, because the access token provided by Cognito does not include an audience.

  1. Start yarn or build the Frontend files for Tornado to serve

  • In the consoleme/ui directory, run yarn

  • Run yarn start to have the frontend served by Yarn on http://localhost:3000. The backend API endpoints will be served by Python (Tornado) on http://localhost:8081.

  • Run yarn build:prod to build the frontend files and put them in a location for the backend to serve. ConsoleMe will be accessible on http://localhost:8081.

  1. Start ConsoleMe by setting the CONFIG_LOCATION environment variable and running consoleme/ with Python in your virtualenv (This was created in the Local Quick Start guide)

export CONFIG_LOCATION=/location/to/your/config.yaml
python /location/to/consoleme/
  1. Visit http://localhost:3000 (if serving via Yarn), or http://localhost:8081 (If you built the frontend files to serve via Tornado) to test.

Last updated