OpenID Connect login based group membership with AWS Cognito

SiCasley

Does anybody have group membership working with a Cognito login? I have set up the oidc login and it works fine, but it wont automatically add my user to a group.

I've set up the group whose membership is controlled by being a member of an OpenID Connect group, and the group name is the same as my group in Cognito.

Here's the groups claim value from the Cognito token:

     'cognito:groups': [ 'test_group' ],

 

My group in AGOL is called test_group

 

Any help would be much appreciated!

MargaretWoo

We are also trying to get this working (on Enterprise Portal v11.4). 

In AWS, we followed the general guidance (using a lambda) to modify the access token claims so that it looks like `"groups": ["test_group"]`. See https://aws.amazon.com/blogs/mobile/how-to-use-cognito-pre-token-generators-to-customize-claims-in-id-tokens/ 

I wonder if there is an ESRI Blog article somewhere that has an example where this works with any OIDC IdP. What does the JWT token look like when it works? Is it using the access_token? or the id_token? What is the attribute name, and is it namespaced?

AWS doesn't allow you to use "groups" as one of its scopes. By any chance, is the portal expecting the scopes attribute in the token to include this?

We also eliminated the possibility that user permissions are an issue by testing this with a user with Administrator role.

In short, I wish this was open source so I could look at the code and answer my own questions. 

Thanks for any attention!