Skip to content

Commit 98aa83d

Browse files
toshketoshke
committed
initial commit
1 parent f3cee29 commit 98aa83d

4 files changed

Lines changed: 315 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
![build-status](https://travis-ci.com/theonestack/hl-component-cognito.svg?branch=master)
2+
3+
### Cfhighlander cognito component
4+
5+
Uses [cloudformation-custom-resources-js](https://github.com/base2Services/cloudformation-custom-resources-nodejs)
6+
as a custom resource code for creating cognito clients and custom domain names.
7+
8+
```bash
9+
10+
# install highlander gem
11+
$ gem install cfhighlander
12+
13+
# build and validate standalone component
14+
$ cfcompile --validate cognito
15+
16+
```
17+
### Usage
18+
19+
Creates Cognito UserPools. Allows adding User pool clients and custom domain name. Note that
20+
this functionality is not supported natively via CloudFormation, and is implemented through
21+
custom resources. Consume component with `Component 'cognito'` in your cfhiglhander template for default behaviour.
22+
Read more on [cfhighlander page](https://github.com/theonestack/cfhighlander) on consuming, extending and inlining components.
23+
24+
### Configuration options
25+
26+
Look at `cognito.config.yaml` for format of configuration file
27+
28+
- `pool_name` - Explicit Cognito UserPool name
29+
- `user_schema` - Defines user attributes.
30+
- `groups` - Create UserGroups alongside with the pool. Allows defining name and description
31+
- `clients` - Cognito OAuth clients to authorize against the pool. Look at `default_client` section
32+
of the config file for required structure
33+
- `domain_name` - Custom domain name for authentication over the web on `https://${domain_name}.auth.${aws_region}.amazoncognito.com` url
34+
- `ccr` - Required for custom resources to be rendered. Do **NOT** alter this configuration value
35+
36+
### Parameters
37+
38+
NONE
39+
40+
### Outputs
41+
42+
`UserPoolId` - PoolId
43+
44+
`UserPoolArn` - Pool Amazon Resource Name (ARN)
45+
46+
`UserPoolProviderURL` - Provider URL
47+
48+
`UserPoolProviderName` - Provider Name
49+
50+
`PoolDomainUrl` - *(Optional)* if custom domain name is set, this will render the full url
51+
52+
`PoolDomainName`- *(Optional)* if custom domain name is set, this will render the domain name
53+
54+
`PoolClient${clietNname}Id` - *(Optional)* client id for every defined client
55+
56+
`PoolClient${clietNname}Secret` - *(Optional)* if client secret is configured on defined client

‎cognito.cfhighlander.rb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
CfhighlanderTemplate do
2+
3+
Name 'cognito'
4+
5+
LambdaFunctions 'ccr'
6+
7+
end

‎cognito.cfndsl.rb‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
CloudFormation do
2+
3+
4+
Cognito_UserPool :UserPool do
5+
UserPoolName pool_name
6+
AliasAttributes alias_attributes
7+
schema = user_schema.collect do |key, val|
8+
{ Name: key,
9+
AttributeDataType: val['type'],
10+
Mutable: val['mutable'],
11+
Required: val['required'] }
12+
end
13+
14+
Schema schema
15+
16+
end
17+
18+
if defined? domain_name and (not domain_name.nil?)
19+
CloudFormation_CustomResource('PoolDomainName') do
20+
ServiceToken FnGetAtt('ccrCognitoDN', 'Arn')
21+
Property 'UserPoolId', Ref(:UserPool)
22+
Property 'Domain', domain_name
23+
Property 'GenerateRandomIfNotAvailable', 'true'
24+
end
25+
26+
Output('PoolDomainUrl') do
27+
Value(FnGetAtt('PoolDomainName', 'DomainFull'))
28+
end
29+
Output('PoolDomainName') do
30+
Value(FnGetAtt('PoolDomainName', 'Domain'))
31+
end
32+
end
33+
34+
35+
def user_pool_client(name, config)
36+
37+
CloudFormation_CustomResource("PoolClient#{name}") do
38+
39+
ServiceToken FnGetAtt('ccrCognitoUPC', 'Arn')
40+
41+
Property 'UserPoolId', Ref(:UserPool)
42+
Property 'ClientName', config['name']
43+
44+
if config.key? 'generate_secret'
45+
Property 'GenerateSecret', config['generate_secret']
46+
end
47+
48+
if config.key? 'explicit_auth_flows'
49+
Property 'ExplicitAuthFlows', config['explicit_auth_flows']
50+
end
51+
52+
if config.key? 'callback_urls'
53+
Property 'CallbackURLs', config['callback_urls']
54+
end
55+
56+
if config.key? 'logout_urls'
57+
Property 'LogoutURLs', config['logout_urls']
58+
end
59+
60+
if config.key? 'default_redirect_uri'
61+
Property 'DefaultRedirectURI', config['default_redirect_uri']
62+
end
63+
64+
if config.key? 'read_attributes'
65+
Property 'ReadAttributes', config['read_attributes']
66+
end
67+
68+
if config.key? 'write_attributes'
69+
Property 'WriteAttributes', config['write_attributes']
70+
end
71+
72+
if config.key? 'refresh_token_validity'
73+
Property 'RefreshTokenValidity', config['refresh_token_validity']
74+
end
75+
76+
if config.key? 'allowed_oauth_flows_userpool_client'
77+
Property 'AllowedOAuthFlowsUserPoolClient', config['allowed_oauth_flows_userpool_client']
78+
end
79+
80+
if config.key? 'allowed_oauth_flows'
81+
Property 'AllowedOAuthFlows', config['allowed_oauth_flows']
82+
end
83+
84+
if config.key? 'allowed_oauth_scopes'
85+
Property 'AllowedOAuthScopes', config['allowed_oauth_scopes']
86+
end
87+
88+
if config.key? 'supported_identity_providers'
89+
Property 'SupportedIdentityProviders', config['supported_identity_providers']
90+
elsif config.key? 'allow_cognito_idp' and config['allow_cognito_idp']
91+
Property 'SupportedIdentityProviders', ['COGNITO']
92+
end
93+
94+
if config.key? 'skip_update'
95+
Property 'SkipUpdate', config['skip_update']
96+
end
97+
98+
end
99+
100+
Output("PoolClient#{name}Id") do
101+
Value(FnGetAtt("PoolClient#{name}", 'UserPoolClient.ClientId'))
102+
end
103+
104+
if (config.key? 'generate_secret') and (config['generate_secret'])
105+
if config.key? 'output_secret' and config['output_secret']
106+
Output("PoolClient#{name}Secret") do
107+
Value(FnGetAtt("PoolClient#{name}", 'UserPoolClient.ClientSecret'))
108+
end
109+
end
110+
end
111+
112+
end
113+
114+
def user_pool_group(name, config)
115+
Cognito_UserPoolGroup("UserGroup#{name}") do
116+
117+
GroupName config['name']
118+
Description config['description']
119+
Precedence config['precedence'] if config.key? 'precedence'
120+
UserPoolId Ref(:UserPool)
121+
end
122+
end
123+
124+
125+
if defined? clients and (not clients.nil?)
126+
clients.each do |key, config|
127+
user_pool_client(key, config)
128+
end
129+
else
130+
user_pool_client(:defaultPoolClient, default_client)
131+
end
132+
133+
134+
if defined? groups and (not groups.nil?)
135+
groups.each do |key, config|
136+
user_pool_group(key, config)
137+
end
138+
else
139+
user_pool_group(:defaultUserGroup, default_user_group)
140+
end
141+
142+
143+
Output(:UserPoolId) do
144+
Value(Ref(:UserPool))
145+
end
146+
147+
Output(:UserPoolArn) do
148+
Value(FnGetAtt(:UserPool, 'Arn'))
149+
end
150+
151+
Output(:UserPoolProviderURL) do
152+
Value(FnGetAtt(:UserPool, 'ProviderURL'))
153+
end
154+
155+
Output(:UserPoolProviderName) do
156+
Value(FnGetAtt(:UserPool, 'ProviderName'))
157+
end
158+
159+
end

‎cognito.config.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
###
2+
### For more information
3+
### https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html
4+
### https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolgroup.html
5+
### https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
6+
###
7+
8+
pool_name: cfhighlander_user_pool
9+
alias_attributes:
10+
- email
11+
12+
# Uncomment following line, if you want user pool
13+
# domain enabled for your cognito pool
14+
# resulting in domain https://${domain_name}.auth.${aws_region}.amazoncognito.com
15+
# domain_name: myscustomdomain
16+
17+
default_client:
18+
name: cfhighlander_user_pool_client
19+
generate_secret: true
20+
output_secret: true
21+
callback_urls:
22+
- http://localhost:3000
23+
logout_urls:
24+
- http://localhost:3000/log_out
25+
default_redirect_uri: http://localhost:3000/
26+
allowed_oauth_scopes:
27+
- openid
28+
- profile
29+
refresh_token_validity: 30
30+
allowed_oauth_flows_userpool_client: true
31+
allowed_oauth_flows:
32+
- client_credentials
33+
explicit_auth_flows: []
34+
skip_update: false
35+
allow_cognito_idp: true
36+
37+
default_user_group:
38+
name: default_user_group
39+
description: Update cfhighlander cognito component configuration to define user groups
40+
precedence: 10
41+
42+
user_schema:
43+
email:
44+
type: String # can be String, Number, DateTime, or Boolean.
45+
mutable: true # defines whether user attribute value can be changed
46+
required: true
47+
name:
48+
type: String
49+
mutable: true
50+
required: true
51+
52+
### Apart from these 2 attributes, CognitoDefaults will be added, and they include
53+
### these attributes are also included in defaults, but in order to override mutable/required properties
54+
### they are also explicitly included here
55+
56+
### Specifying any clients under clients key will render default_client unused
57+
clients:
58+
# client1:
59+
# name: my_client
60+
# # check default_client for configuration values
61+
62+
### Specifying any groups under groups key will render default_user_group unused
63+
groups:
64+
# group1:
65+
# name: usergroup
66+
# description: This group gives access to X
67+
68+
69+
ccr:
70+
custom_policies:
71+
cognito:
72+
action:
73+
- cognito-idp:*
74+
roles:
75+
cognito:
76+
policies_inline:
77+
- cloudwatch-logs
78+
- cognito
79+
functions:
80+
ccrCognitoUPC:
81+
role: cognito
82+
code: https://github.com/base2Services/cloudformation-custom-resources-nodejs/releases/download/1.0.0/ccr-nodejs-1.0.0.zip
83+
runtime: nodejs6.10
84+
named: false
85+
timeout: 30
86+
handler: cognito-user-pool-client/index.handler
87+
ccrCognitoDN:
88+
role: cognito
89+
code: https://github.com/base2Services/cloudformation-custom-resources-nodejs/releases/download/1.0.0/ccr-nodejs-1.0.0.zip
90+
runtime: nodejs6.10
91+
named: false
92+
timeout: 30
93+
handler: cognito-user-pool-domain/index.handler

0 commit comments

Comments
 (0)