topic Re: OpenID Connect login based group membership with AWS Cognito in ArcGIS Online Questions

OpenID Connect login based group membership with AWS Cognito

SiCasley — Thu, 19 Sep 2024 23:41:19 GMT

Does anybody have group membership working with a Cognito login? I have set up the oidc login and it works fine, but it wont automatically add my user to a group.

I've set up the group whose membership is controlled by being a member of an OpenID Connect group, and the group name is the same as my group in Cognito.

Here's the groups claim value from the Cognito token:

'cognito:groups': [ 'test_group' ],

My group in AGOL is called test_group

Any help would be much appreciated!

Re: OpenID Connect login based group membership with AWS Cognito

MargaretWoo — Tue, 31 Dec 2024 20:56:28 GMT

We are also trying to get this working (on Enterprise Portal v11.4).

In AWS, we followed the general guidance (using a lambda) to modify the access token claims so that it looks like `"groups": ["test_group"]`. See https://aws.amazon.com/blogs/mobile/how-to-use-cognito-pre-token-generators-to-customize-claims-in-id-tokens/

I wonder if there is an ESRI Blog article somewhere that has an example where this works with any OIDC IdP. What does the JWT token look like when it works? Is it using the access_token? or the id_token? What is the attribute name, and is it namespaced?

AWS doesn't allow you to use "groups" as one of its scopes. By any chance, is the portal expecting the scopes attribute in the token to include this?

We also eliminated the possibility that user permissions are an issue by testing this with a user with Administrator role.

In short, I wish this was open source so I could look at the code and answer my own questions.

Thanks for any attention!

Re: OpenID Connect login based group membership with AWS Cognito

SiCasley — Thu, 02 Jan 2025 17:47:00 GMT

I think it's using the id_token (but I can't say for sure!). Working with tech support we've been able to get a bug logged for this: "BUG-000172874 - Enable OpenID Connect login-based group membership does not work when single sign-on is configured with Amazon Cognito as the IdP", so hopefully it'll get fixed in the near future.

Re: OpenID Connect login based group membership with AWS Cognito

MargaretWoo — Thu, 06 Feb 2025 15:31:29 GMT

Just updating that on our side, we've gotten a bug and an enhancement logged for this:

BUG-000174090-Integrate OpenID groups when using AWS Cognito for Portal for ArcGIS
ENH-000169368-Provide Documentation for Configuring OpenID via API