I'm trying to work out what the best plan of attack would be to get SSO functionality while continuing to use AWS Cognito. I've come up with a solution that works, but I'm curious if anything has any input, or any critiques on something obvious.
We've got an AWS Cognito User Pool for storing all of ours users. We use an ASP.NET Core Web API that essentially acts as a broker between Cognito & our front-end Angular applications. The angular applications provide credentials, the Web API authenticates them in Cognito and returns a JWT token used for subsequent client side requests to the Web API.
The idea behind this was so that our multiple applications didn't have to replicate a bunch of Cognito logic, and instead have that sit in the Web API. These applications sit on different sub-domains, and log in happens separately on each one.
We'd now like to implement SSO, where once you've logged into the main application, you can access any of the other applications without needing to sign in again. I've achieved this by moving from session storage to cookies, allowing us to transfer JWT tokens across applications. This seems to work fine.
My question is, is there a better way to approach this? Possibly something built into AWS? We'd like to stick with the AWS eco-system, but it doesn't appear that Cognito really provides this.
Any thoughts would be greatly appreciated.