AuthenticateCognitoAction

class aws_cdk.aws_elasticloadbalancingv2_actions.AuthenticateCognitoAction(*, next, user_pool, user_pool_client, user_pool_domain, authentication_request_extra_params=None, on_unauthenticated_request=None, scope=None, session_cookie_name=None, session_timeout=None)

Bases: ListenerAction

A Listener Action to authenticate with Cognito.

ExampleMetadata:

lit=test/integ.cognito.lit.ts infused

Example:

import aws_cdk.aws_cognito as cognito
import aws_cdk.aws_ec2 as ec2
import aws_cdk.aws_elasticloadbalancingv2 as elbv2
from aws_cdk.core import App, CfnOutput, Stack
from constructs import Construct
import aws_cdk.aws_elasticloadbalancingv2_actions as actions

Stack): lb = elbv2.ApplicationLoadBalancer(self, "LB",
    vpc=vpc,
    internet_facing=True
)

user_pool = cognito.UserPool(self, "UserPool")
user_pool_client = cognito.UserPoolClient(self, "Client",
    user_pool=user_pool,

    # Required minimal configuration for use with an ELB
    generate_secret=True,
    auth_flows=cognito.AuthFlow(
        user_password=True
    ),
    o_auth=cognito.OAuthSettings(
        flows=cognito.OAuthFlows(
            authorization_code_grant=True
        ),
        scopes=[cognito.OAuthScope.EMAIL],
        callback_urls=[f"https://{lb.loadBalancerDnsName}/oauth2/idpresponse"
        ]
    )
)
cfn_client = user_pool_client.node.default_child
cfn_client.add_property_override("RefreshTokenValidity", 1)
cfn_client.add_property_override("SupportedIdentityProviders", ["COGNITO"])

user_pool_domain = cognito.UserPoolDomain(self, "Domain",
    user_pool=user_pool,
    cognito_domain=cognito.CognitoDomainOptions(
        domain_prefix="test-cdk-prefix"
    )
)

lb.add_listener("Listener",
    port=443,
    certificates=[certificate],
    default_action=actions.AuthenticateCognitoAction(
        user_pool=user_pool,
        user_pool_client=user_pool_client,
        user_pool_domain=user_pool_domain,
        next=elbv2.ListenerAction.fixed_response(200,
            content_type="text/plain",
            message_body="Authenticated"
        )
    )
)

CfnOutput(self, "DNS",
    value=lb.load_balancer_dns_name
)

app = App()
CognitoStack(app, "integ-cognito")
app.synth()

Authenticate using an identity provide (IdP) that is compliant with OpenID Connect (OIDC).

Parameters:

  • next (ListenerAction) – What action to execute next. Multiple actions form a linked chain; the chain must always terminate in a (weighted)forward, fixedResponse or redirect action.

  • user_pool (IUserPool) – The Amazon Cognito user pool.

  • user_pool_client (IUserPoolClient) – The Amazon Cognito user pool client.

  • user_pool_domain (IUserPoolDomain) – The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.

  • authentication_request_extra_params (Optional[Mapping[str, str]]) – The query parameters (up to 10) to include in the redirect request to the authorization endpoint. Default: - No extra parameters

  • on_unauthenticated_request (Optional[UnauthenticatedAction]) – The behavior if the user is not authenticated. Default: UnauthenticatedAction.AUTHENTICATE

  • scope (Optional[str]) – The set of user claims to be requested from the IdP. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP. Default: “openid”

  • session_cookie_name (Optional[str]) – The name of the cookie used to maintain session information. Default: “AWSELBAuthSessionCookie”

  • session_timeout (Optional[Duration]) – The maximum duration of the authentication session. Default: Duration.days(7)

Methods

bind(scope, listener, associating_construct=None)

Called when the action is being used in a listener.

Parameters:
Return type:

None

render_actions()

Render the actions in this chain.

Return type:

List[ActionProperty]

Static Methods

classmethod authenticate_oidc(*, authorization_endpoint, client_id, client_secret, issuer, next, token_endpoint, user_info_endpoint, authentication_request_extra_params=None, on_unauthenticated_request=None, scope=None, session_cookie_name=None, session_timeout=None)

Authenticate using an identity provider (IdP) that is compliant with OpenID Connect (OIDC).

Parameters:

  • authorization_endpoint (str) – The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

  • client_id (str) – The OAuth 2.0 client identifier.

  • client_secret (SecretValue) – The OAuth 2.0 client secret.

  • issuer (str) – The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

  • next (ListenerAction) – What action to execute next.

  • token_endpoint (str) – The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

  • user_info_endpoint (str) – The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.

  • authentication_request_extra_params (Optional[Mapping[str, str]]) – The query parameters (up to 10) to include in the redirect request to the authorization endpoint. Default: - No extra parameters

  • on_unauthenticated_request (Optional[UnauthenticatedAction]) – The behavior if the user is not authenticated. Default: UnauthenticatedAction.AUTHENTICATE

  • scope (Optional[str]) – The set of user claims to be requested from the IdP. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP. Default: “openid”

  • session_cookie_name (Optional[str]) – The name of the cookie used to maintain session information. Default: “AWSELBAuthSessionCookie”

  • session_timeout (Optional[Duration]) – The maximum duration of the authentication session. Default: Duration.days(7)

See:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#oidc-requirements

Return type:

ListenerAction

classmethod fixed_response(status_code, *, content_type=None, message_body=None)

Return a fixed response.

Parameters:

  • status_code (Union[int, float]) –

  • content_type (Optional[str]) – Content Type of the response. Valid Values: text/plain | text/css | text/html | application/javascript | application/json Default: - Automatically determined

  • message_body (Optional[str]) – The response body. Default: - No body

See:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#fixed-response-actions

Return type:

ListenerAction

classmethod forward(target_groups, *, stickiness_duration=None)

Forward to one or more Target Groups.

Parameters:

  • target_groups (Sequence[IApplicationTargetGroup]) –

  • stickiness_duration (Optional[Duration]) – For how long clients should be directed to the same target group. Range between 1 second and 7 days. Default: - No stickiness

See:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#forward-actions

Return type:

ListenerAction

classmethod redirect(*, host=None, path=None, permanent=None, port=None, protocol=None, query=None)

Redirect to a different URI.

A URI consists of the following components: protocol://hostname:port/path?query. You must modify at least one of the following components to avoid a redirect loop: protocol, hostname, port, or path. Any components that you do not modify retain their original values.

You can reuse URI components using the following reserved keywords:

  • #{protocol}

  • #{host}

  • #{port}

  • #{path} (the leading “/” is removed)

  • #{query}

For example, you can change the path to “/new/#{path}”, the hostname to “example.#{host}”, or the query to “#{query}&value=xyz”.

Parameters:

  • host (Optional[str]) – The hostname. This component is not percent-encoded. The hostname can contain #{host}. Default: - No change

  • path (Optional[str]) – The absolute path, starting with the leading “/”. This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. Default: - No change

  • permanent (Optional[bool]) – The HTTP redirect code. The redirect is either permanent (HTTP 301) or temporary (HTTP 302). Default: false

  • port (Optional[str]) – The port. You can specify a value from 1 to 65535 or #{port}. Default: - No change

  • protocol (Optional[str]) – The protocol. You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You cannot redirect HTTPS to HTTP. Default: - No change

  • query (Optional[str]) – The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading “?”, as it is automatically added. You can specify any of the reserved keywords. Default: - No change

See:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#redirect-actions

Return type:

ListenerAction

classmethod weighted_forward(target_groups, *, stickiness_duration=None)

Forward to one or more Target Groups which are weighted differently.

Parameters:

  • target_groups (Sequence[Union[WeightedTargetGroup, Dict[str, Any]]]) –

  • stickiness_duration (Optional[Duration]) – For how long clients should be directed to the same target group. Range between 1 second and 7 days. Default: - No stickiness

See:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#forward-actions

Return type:

ListenerAction