How to use Azure AD B2C as IdP for Amazon Cognito
Tags: aws, azure, oidc, cognito
Published: 2020-09-08 10:36:46

[Amazon Cognito](https://aws.amazon.com/cognito/) is almost an integral part of an [AWS](https://aws.amazon.com/) cloud architecture. The integration in several AWS services is really great. But many enterprise companies maintain their user identities in [Azure AD](https://azure.microsoft.com/en-us/services/active-directory/).

In this blog post I explain how you can use [Azure AD B2C](https://azure.microsoft.com/en-us/services/active-directory/external-identities/b2c/) as identity provider for Amazon Cognito. This requires some steps, so it is a step-by-step guide.

## Configure Amazon Cognito Hosted UI

With Amazon Cognito you can provision a hosted UI for the authentication. The hosted UI is the foundation for other features such as the ability to sign in directly to your user pool through OpenID Connect (OIDC) and SAML identity providers.

### Create an app client

1. Select an existing user pool or create a new one
2. Go to **General settings** -> **App clients** -> **Add an app client**
3. Give your app client a name
4. Deselect the option **Generate client secret**
5. Create the app client and note the App client ID

![Add an app client](https://dev-to-uploads.s3.amazonaws.com/i/6t9fweinrvnascyg7bmd.jpg)

[📖 Documentation: Using the Hosted UI](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-integration.html)

### Configure the hosted UI domain name

1. Go to **App integration** -> **Domain name**
2. Enter an available domain prefix and make a note of the complete address

![Domain name](https://dev-to-uploads.s3.amazonaws.com/i/scoibv19m3tg1f3t2ivo.jpg)

[📖 Documentation: Configuring a Domain](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-assign-domain.html)

## App Registration with Azure AD B2C

Next we have to switch to the Azure Portal to register a new web application in Azure Active Directory B2C.

1. Go to **Manage** -> **App registrations** and create a **New registration**
2. Give your app a name
3. Choose a supported account type
4. Enter your Amazon Cognito hosted UI domain name and append `/oauth2/idpresponse`. For example `https://domain-prefix.auth.eu-central-1.amazoncognito.com/oauth2/idpresponse`
5. Go to **Manage** -> **Certificates & secrets**
6. Create a **New client secret**, choose **Expires: Never** and make a note of the secret value
7. Switch to the **Overview** and make a note of the **Application (client) ID** and the **Directory (tenant) ID**

[📖 Documentation: Register an application](https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-register-applications?tabs=app-reg-ga)

## Add an OpenID Connect Identity Provider to a User Pool

Back to Amazon Cognito. In this step I add an OIDC identity provider to the User Pool and create the attribute mapping. For this we need the notes from the previous step.

### Add an Identity Provider

Go to **Federation** -> **Identity providers** and choose **OpenID Connect**

| Name | Value |
| ---- | ----- |
| Provider name | A name of your choice |
| Client ID | Azure AD Application (client) ID |
| Client secret | Azure AD client secret |
| Attributes request method | `GET` |
| Authorize scope | `profile email openid` |
| Issuer | `https://login.microsoftonline.com/DIRECTORY-TENANT-ID/v2.0` Replace the `DIRECTORY-TENANT-ID` with the Azure AD Directory (tenant) ID |

![OpenID Connect](https://dev-to-uploads.s3.amazonaws.com/i/5ojspuxq6i4ekh6yas6d.jpg)

[📖 Documentation: Adding OIDC Providers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-oidc-idp.html)

### OIDC Attribute mapping

1. Go to **Federation** -> **Attribute mapping**
2. Choose **OIDC** and select your identity provider
3. Create a mapping between the OIDC attribute and the User pool attribute

| OIDC attribute | User pool attribute |
| -------------- | ------------------- |
| name           | Name                |
| username       | Preferred User Name |
| email          | Email               |
| sub            | Username            |

![Attribute mapping](https://dev-to-uploads.s3.amazonaws.com/i/su752vudgjwcdfx40hd9.jpg)

[📖 Documentation: Specifying Attribute Mappings](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.html)

### Configure the app client

1. Go to **App integration** -> **App client settings**
2. Select your identity provider as one of the **Enabled Identity Providers**
3. Enter a callback URL for the authorization server to redirect after users are authenticated
4. Enter a sign out URL
5. Select **Authorization code grant**
6. Select the `email`, `openid`, and `aws.cognito.signin.user.admin` check boxes for the **Allowed OAuth scopes**

![App client settings](https://dev-to-uploads.s3.amazonaws.com/i/rts0ykebxkmabemi3psx.jpg)

[📖 Documentation: Add an App to Enable the Hosted Web UI](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-configuring-app-integration.html)

---

If you have any kind of feedback, suggestions or ideas - feel free to comment this post!