Using same authentication with cognito and amazon connect in a app-web

[PabloApser]

Hello,

I have an app web that requires authentication with cognito and I want to login in the custom ccp from Amazon Connect simultaneously. I don't want the user to login twice. Is it possible to use some jwt token or something with the connect streams for it?

I'm interested in hearing any other approach to the problem that works. (Without cognito...idk)

Thanks !

[jagadeeshaby]

See if this helps in anyway - https://aws.amazon.com/blogs/security/how-to-set-up-amazon-cognito-for-federated-authentication-using-azure-ad/

You may need to tie back your Cognito solution with a SAML 2.0 Identity provider which will help you to enable single sign on to Amazon connect.

Additional documents to follow up

• https://docs.aws.amazon.com/connect/latest/adminguide/configure-saml.html
• https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html

[PabloApser]

Thank you! I´m going to explore your solution

[hxgnZO]

Did you come up with a way to accomplish this? Something I would find really useful. From what I am able to discover- the Federation from our organizations IDP requires us to essentially setup a different client app to direct to the way they do for Connect. It's been a real pain for me actually. I feel like it'd be a really useful feature/option to allow users who logged into connect to reuse their credentials to get IAM perms/use the JS SDK with the token etc. I think it really just depends on how you are providing access and who can/can't have explicit creds.

[hxgnZO]

As an update; I did get a cognito solution to work, but it is a separate client app rather than reusing the connect setup, that I'd have to build an interface for. However for API calls and such the ability to get client creds on our CMS backend is useful to authenticate API calls that go through Lambda or whatever service is needed after that. I do wish there was a cleaner solution (there probably is that I don't know about) the mapping roles to AD users is a PITA.