Cognito Google federated auth deploy test

.COGNITO_GOOGLE_AUTH.md

hello

.gitignore

env
*.pyc
__pycache__
tmp
setenv-priv.sh

app.props

AppName=polyreader-social-demo

delete_stack.sh

#!/usr/bin/env bash

. app.props

aws cloudformation delete-stack --stack-name $AppName

deploy_stack.sh

#!/usr/bin/env bash

. app.props

aws cloudformation deploy --stack-name $AppName --template-file stack.json --capabilities CAPABILITY_NAMED_IAM  --parameter-overrides DomainName=$DOMAIN_NAME GoogleClientId=$GOOGLE_CLIENT_ID GoogleClientSecret=$GOOGLE_CLIENT_SECRET

list_events.sh

#!/usr/bin/env bash

. app.props

aws cloudformation describe-stack-events --stack-name $AppName --query "StackEvents[].{\"1.Timestamp\":Timestamp,\"2.Id\":LogicalResourceId,\"3.Type\":ResourceType,\"4.Status\":ResourceStatus,\"5.Reason\":ResourceStatusReason}"

list_outputs.sh

#!/usr/bin/env bash

. app.props

aws cloudformation describe-stacks --stack-name $AppName --query 'Stacks[0].Outputs' --output table

list_resources.sh

#!/usr/bin/env bash

. app.props

aws cloudformation describe-stack-resources --stack-name $AppName --query "StackResources[].{\"1.Timestamp\":Timestamp,\"2.LogicalId\":LogicalResourceId,\"3.PhysicalId\":PhysicalResourceId,\"4.Type\":ResourceType,\"5.Status\":ResourceStatus}"

list_stacks.sh

#!/usr/bin/env bash

aws cloudformation describe-stacks --query "Stacks[].{\"1.Name\":StackName,\"2.Status\":StackStatus}"

NOTES.md

requirements.txt

awscli
botocoro
boto3
pyyaml

setenv.sh

#!/usr/bin/env bash

export AWS_DEFAULT_OUTPUT=table
export AWS_PROFILE=#{your-aws-profile-here}
export AWS_REGION=#{your-aws-region-here}
export DOMAIN_NAME=#{your-domain-name-here}
export GOOGLE_CLIENT_ID=#{your-google-client-id-here}
export GOOGLE_CLIENT_SECRET=#{your-google-client-secret-here}

stack.json

{
    "Outputs": {
	"AppUserPool": {
	    "Value": {
		"Ref": "AppUserPool"
	    }
	},
	"AppUserPoolClient": {
	    "Value": {
		"Ref": "AppUserPoolClient"
	    }
	},
	"AppUserPoolDomain": {
	    "Value": {
		"Ref": "AppUserPoolDomain"
	    }
	}
    },
    "Parameters": {
	"DomainName": {
	    "Type": "String"
	},	
	"GoogleClientId": {
	    "Type": "String"
	},
	"GoogleClientSecret": {
	    "Type": "String"
	}
    },
    "Resources": {
	"AppUserPool": {
	    "Properties": {
		"AutoVerifiedAttributes": [
		    "email"
		],
		"Policies": {
		    "PasswordPolicy": {
			"MinimumLength": 8,
			"RequireLowercase": true,
			"RequireNumbers": true,
			"RequireSymbols": true,
			"RequireUppercase": true
		    }
		},
		"Schema": [
		    {
			"AttributeDataType": "String",
			"Mutable": true,
			"Name": "email",
			"Required": true,
			"StringAttributeConstraints": {
			    "MinLength": "1"
			}
		    },
		    {
			"AttributeDataType": "String",
			"Mutable": true,
			"Name": "foo"
		    }
		],
		"UsernameAttributes": [
		    "email"
		],
		"UsernameConfiguration": {
		    "CaseSensitive": false
		}
	    },
	    "Type": "AWS::Cognito::UserPool"
	},
	"AppUserPoolClient": {
	    "Properties": {
		"CallbackURLs": [
		    {
			"Fn::Sub": "https://${AppUserPoolDomain}.auth.${AWS::Region}.amazoncognito.com/oauth2/idpresponse"
		    }
		],
		"ExplicitAuthFlows": [
		    "ALLOW_USER_SRP_AUTH",
		    "ALLOW_ADMIN_USER_PASSWORD_AUTH",
		    "ALLOW_REFRESH_TOKEN_AUTH"
		],
		"LogoutURLs": [
		    {
			"Fn::Sub": "https://${DomainName}"
		    }
		],
		"PreventUserExistenceErrors": "ENABLED",
		"SupportedIdentityProviders": [
		    "COGNITO",
		    "Google"
		],
		"UserPoolId": {
		    "Ref": "AppUserPool"
		}
	    },
	    "Type": "AWS::Cognito::UserPoolClient"
	},
	"AppUserPoolDomain": {
	    "Properties": {
		"Domain": {
		    "Fn::Sub": "${AWS::StackName}"
		},
		"UserPoolId": {
		    "Ref": "AppUserPool"
		}
	    },
	    "Type": "AWS::Cognito::UserPoolDomain"
	},
	"GoogleUserPoolIdentityProvider": {
	    "Properties": {
		"ProviderDetails": {
		    "authorize_scopes": "openid email profile",
		    "client_id": {
			"Ref": "GoogleClientId"
		    },
		    "client_secret": {
			"Ref": "GoogleClientSecret"
		    }
		},
		"ProviderName": "Google",
		"ProviderType": "Google",
		"UserPoolId": {
		    "Ref": "AppUserPool"
		}
	    },
	    "Type": "AWS::Cognito::UserPoolIdentityProvider"
	}
    }
}

TODO.md

short

• test deployment

pareto2

• UserPoolIdentityProvider needs to subclass name so has a Google- prefix

done

• env variables
• modify deploy.sh