AWS::ElasticLoadBalancingV2::Listener AuthenticateCognitoConfig

Specifies information required when integrating with Amazon Cognito to authenticate users.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "AuthenticationRequestExtraParams" : {Key: Value, ...},
  "OnUnauthenticatedRequest" : String,
  "Scope" : String,
  "SessionCookieName" : String,
  "SessionTimeout" : String,
  "UserPoolArn" : String,
  "UserPoolClientId" : String,
  "UserPoolDomain" : String
}

YAML

  AuthenticationRequestExtraParams: 
    Key: Value
  OnUnauthenticatedRequest: String
  Scope: String
  SessionCookieName: String
  SessionTimeout: String
  UserPoolArn: String
  UserPoolClientId: String
  UserPoolDomain: String

Properties

AuthenticationRequestExtraParams

The query parameters (up to 10) to include in the redirect request to the authorization endpoint.

Required: No

Type: Object of String

Pattern: [a-zA-Z0-9]+

Update requires: No interruption

OnUnauthenticatedRequest

The behavior if the user is not authenticated. The following are possible values:

• deny - Return an HTTP 401 Unauthorized error.

• allow - Allow the request to be forwarded to the target.

• authenticate - Redirect the request to the IdP authorization endpoint. This is the default value.

Required: No

Type: String

Allowed values: deny | allow | authenticate

Update requires: No interruption

Scope

The set of user claims to be requested from the IdP. The default is openid.

To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.

Required: No

Type: String

Update requires: No interruption

SessionCookieName

The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.

Required: No

Type: String

Update requires: No interruption

SessionTimeout

The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).

Required: No

Type: String

Update requires: No interruption

UserPoolArn

The Amazon Resource Name (ARN) of the Amazon Cognito user pool.

Required: Yes

Type: String

Update requires: No interruption

UserPoolClientId

The ID of the Amazon Cognito user pool client.

Required: Yes

Type: String

Update requires: No interruption

UserPoolDomain

The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.

Required: Yes

Type: String

Update requires: No interruption