Cognito

Here are step-by-step directions for configuring Cognito as an identity provider in ConsoleMe:

1. Sign in to AWS, visit Cognito, and create a new User Pool

1. Under App Clients, click "Add an app client"

2. We've selected ALLOW_USER_PASSWORD_AUTH, and left the other settings as defaults

1. Click "Review", give your pool a name if you haven't already, and click "Create Pool".

2. Go back to "App Integration" -> "App Client Settings", enable "Cognito Identity Pool" as a valid Identity Provider, and configure the following urls under callback urls:

http://localhost:8081/auth, http://localhost:8081/oauth2/idpresponse,http://localhost:3000/auth, http://localhost:3000/oauth2/idpresponse

1. Under Allowed OAuth flows, select Authorization code grant

2. Under Allowed OAuth Scopes , select email, openid, and profile.

3. Create a test user and test group under Users and Groups.

4. Change other settings as needed to satisfy your security and authorization needs.

5. Make a ConsoleMe configuration. You can do this by copying example_config/example_config_oidc_cognito_all_in_one.yaml to a directory of your choice and changing the various values in that file to suit your needs. The key values to change are:

• oidc_secrets.client_id = Client ID in Cognito (App Clients -> App Client ID)

• oidc_secrets.secret = Client Secret in Cognito (App Clients -> App Client Secret)

• oidc_secrets.client_scope = List of Scopes granted to the App integration in Cognito. Usually email and openid,

• get_user_by_oidc_settings.jwt_groups_key = 'cognito:groups`

• get_user_by_oidc_settings.metadata_url = The metadata URL of your Cognito Pool. Usually this is the following (Replace {user_pool_id} with your own pool ID):

  • https://cognito-idp.us-east-1.amazonaws.com/{user_pool_id}/.well-known/openid-configuration
• get_user_by_oidc_settings.access_token_audience = This must be set to null, because the access token provided by Cognito does not include an audience.

1. Start yarn or build the Frontend files for Tornado to serve

• In the consoleme/ui directory, run yarn

• Run yarn start to have the frontend served by Yarn on http://localhost:3000. The backend API endpoints will be served by Python (Tornado) on http://localhost:8081.

• Run yarn build:prod to build the frontend files and put them in a location for the backend to serve. ConsoleMe will be accessible on http://localhost:8081.

1. Start ConsoleMe by setting the CONFIG_LOCATION environment variable and running consoleme/__main__.py with Python in your virtualenv (This was created in the Local Quick Start guide)

export CONFIG_LOCATION=/location/to/your/config.yaml
python /location/to/consoleme/__main__.py

1. Visit http://localhost:3000 (if serving via Yarn), or http://localhost:8081 (If you built the frontend files to serve via Tornado) to test.