webiny-cognito-federation

Add a federation prop to the <Cognito /> component in webiny.config.tsx with a domain, callbackUrls, and an identityProviders array containing your provider type and credentials. This provisions the Cognito IdP resources, OAuth client, and login screen buttons automatically.

Create an apiConfig extension implementing CognitoIdpConfig.Interface with a getIdentity method that reads claims like cognito:groups from the JWT and returns roles and teams slugs. Reference the file via the apiConfig prop on <Cognito />.

Yes, set allowCredentialsLogin to false in the federation object to hide the credentials form. For conditional logic such as IP whitelists, implement a custom CognitoSignInConfig via the adminConfig prop.

Yes, use type "oidc" with a custom name, label, and providerDetails including client_id, client_secret, and oidc_issuer. You can also pass federation as an async function to fetch credentials from a secrets manager at deploy time.

Webiny uses custom:id as the primary user identifier, mapped to the IdP's sub claim by default. Always include it in custom attributeMapping unless the IdP's sub exceeds 36 characters on pools deployed before Webiny 6.4.4.

Cognito federation keeps Cognito as the user pool while delegating authentication to external IdPs. If you want Okta or Auth0 to fully replace Cognito as the identity provider, use the dedicated webiny-configure-okta or webiny-configure-auth0 skills instead.