Some time ago I had to implement authorization and authentication for REST (.NET Core 2.1, the latest stable nuget package version is 2.1.3) web service using JWT tokens (bearer) using AWS Cognito Identity Pools. It was pretty hard to find the updated tutorials or materials (even on AWS most of the data is about old .NET). For AWS integration I used AWS SDK in the latest version (3.3.x)

Following nuget packages are required:

• AWSSDK.Core
• AWSSDK.CognitoIdentityProvider
• AWSSDK.Extensions.CognitoAuthentication

I will not describe how to setup AWS Cognito – it is pretty well documented. Much harder is correct setup of .NET Core application.

Lets enumerate what variables we will need to login:

• region name – region where Identity Pool was set up
• pool id – unique pool name
• clientId – unique Cognito client ID
• secretKey – key generated on Identity Pool creation
• issuer – https://cognito-idp.{region name}.amazonaws.com/{pool id}
• useHttps – indicates if it uses HTTP (false) or HTTPS (true)
• expo – value required to calculate RSA key
• key – key required to calculate RSA key

Getting expo and key values is not obvious – these values are hidden in https://cognito-idp.{region name}.amazonaws.com/{pool id}/.well-known/jwks.json in fields e for expo and n for key (this one is very long value). These fields are used to calculate RSA key to validate bearer token.

Let focus first on configuration in Startup.cs.

            services.AddAuthentication(o => o.DefaultScheme = JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
            {
                options.Audience = Configuration["cognito:clientId"];
                options.TokenValidationParameters = this.TokenValidationParameters();
                options.IncludeErrorDetails = true;
                options.SaveToken = true;
                options.Authority = Configuration["cognito:issuer"];
                options.RequireHttpsMetadata = bool.Parse(Configuration["cognito:useHttps"]);
            });

            services.AddAuthorization(auth =>
            {
                auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
                    .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme‌​)
                    .RequireAuthenticatedUser()
                    .Build());
            });

So how to generate token validation parameters? It is pretty easy and well documented on AWS forum (thread with code). Personally, I’ve implemented that in a little bit different way, but it is only detail.

So now – how to register, confirm and login user?

We need an instance of the identity provider. Also a piece of code which will generate secret hash is required. Secret hash has to be attached to each request as a kind of signature. Setting up Identity Pool for an application, it is required to choose attributes. The names are a little bit different than on the list (e.g. Phone/Phone number is phone_number). Just a side note regarding phone number – required format is +COUNTRY_NUMBERXXXXXXXXX so for Poland it would be +48123456789.

Up to configuration, confirmation code is send to the user via email or SMS. After account creation it has to be confirmed and at the end we can login. In login request, the value of AuthFlow parameter depends on what was setup in Cognito. Passing through many samples the most often choosen value was AuthFlowType.ADMIN_NO_SRP_AUTH.

        private AmazonCognitoIdentityProviderClient provider;
        private IConfiguration configuration;

        ...

        public async Task Register(string username, string password)
        {
            var signUpRequest = new SignUpRequest
            {
                ClientId = configuration["cognito:clientId"],
                SecretHash = GetSecretHash(username, configuration["cognito:clientId"], configuration["cognito:secretKey"]),
                Username = username,
                Password = password,
                UserAttributes = new System.Collections.Generic.List<AttributeType>
                {
                // attributes set in Cognito as mandatory and optional, without mandatory account will not be created
                }
            };

            await provider.SignUpAsync(signUpRequest);
        }

        public async Task Confirm(string username, string confirmationCode)
        {
            ConfirmSignUpRequest confirmRequest = new ConfirmSignUpRequest
            {
                Username = username,
                ClientId = configuration["cognito:clientId"],
                ConfirmationCode = confirmationCode,
                SecretHash = GetSecretHash(username, configuration["cognito:clientId"], configuration["cognito:secretKey"])
            };

            await provider.ConfirmSignUpAsync(confirmRequest);
        }

        public async Task<string> Login(string username, string password)
        {
            var authReq = new AdminInitiateAuthRequest
            {
                UserPoolId = configuration["cognito:poolId"],
                ClientId = configuration["cognito:clientId"],
                AuthFlow = AuthFlowType.ADMIN_NO_SRP_AUTH,
            };
            authReq.AuthParameters.Add("USERNAME", username);
            authReq.AuthParameters.Add("PASSWORD", password);
            authReq.AuthParameters.Add("SECRET_HASH", GetSecretHash(username, configuration["cognito:clientId"], configuration["cognito:secretKey"]));

            var authResp = await provider.AdminInitiateAuthAsync(authReq);
            return authResp.AuthenticationResult.IdToken;
        }

Now we have to consider how to get username after login process. It would be too obvious to get it automatically in User.Identity.Name. We have to get if from claims (like all other parameter values (whatever was choosen in cognito – phone number etc).

this.User.Claims.First(x => x.Type == "cognito:username").Value

And that is all code which you need to use now [Authorize] attribute in your code controllers and actions (of course after implementing proper actions on your controller(s) to register, confirm and login user).

The token is alive during 1 hour. Later the token has to be refreshed.