I'm trying to work out what the best plan of attack would be to get SSO functionality while continuing to use AWS Cognito. I've come up with a solution that works, but I'm curious if anything has any input, or any critiques on something obvious.

We've got an AWS Cognito User Pool for storing all of ours users. We use an ASP.NET Core Web API that essentially acts as a broker between Cognito & our front-end Angular applications. The angular applications provide credentials, the Web API authenticates them in Cognito and returns a JWT token used for subsequent client side requests to the Web API.

The idea behind this was so that our multiple applications didn't have to replicate a bunch of Cognito logic, and instead have that sit in the Web API. These applications sit on different sub-domains, and log in happens separately on each one.

We'd now like to implement SSO, where once you've logged into the main application, you can access any of the other applications without needing to sign in again. I've achieved this by moving from session storage to cookies, allowing us to transfer JWT tokens across applications. This seems to work fine.

My question is, is there a better way to approach this? Possibly something built into AWS? We'd like to stick with the AWS eco-system, but it doesn't appear that Cognito really provides this.

Any thoughts would be greatly appreciated.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.