Amazon Cognito is a web service that delivers scoped temporary credentials to mobile devices and other untrusted environments. Amazon Cognito uniquely identifies a device and supplies the user with a consistent identity over the lifetime of an application.
Using Amazon Cognito, you can enable authentication with one or more third-party identity providers (Facebook, Google, or Login with Amazon), and you can also choose to support unauthenticated access from your app. Cognito delivers a unique identifier for each user and acts as an OpenID token provider trusted by AWS Security Token Service (STS) to access temporary, limited-privilege AWS credentials.
To provide end-user credentials, first make an unsigned call to GetId. If the
end user is authenticated with one of the supported identity providers, set the Logins
map with the identity provider token. GetId returns a unique identifier
for the user.
Next, make an unsigned call to GetCredentialsForIdentity. This call expects
the same Logins map as the GetId call, as well as the IdentityID
originally returned by GetId. Assuming your identity pool has been configured
via the SetIdentityPoolRoles operation, GetCredentialsForIdentity
will return AWS credentials for your use. If your pool has not been configured with
SetIdentityPoolRoles, or if you want to follow legacy flow, make an unsigned
call to GetOpenIdToken, which returns the OpenID token necessary to call STS
and retrieve AWS credentials. This call expects the same Logins map as
the GetId call, as well as the IdentityID originally returned
by GetId. The token returned by GetOpenIdToken can be passed
to the STS operation AssumeRoleWithWebIdentity
to retrieve AWS credentials.
If you want to use Amazon Cognito in an Android, iOS, or Unity application, you will probably want to make API calls via the AWS Mobile SDK. To learn more, see the AWS Mobile SDK Developer Guide.
Inheritance Hierarchy
Namespace: Amazon.CognitoIdentity
Assembly: AWSSDK.dll
Version: (assembly version)
Syntax
public class AmazonCognitoIdentityClient : AmazonServiceClient IAmazonCognitoIdentity, IDisposable
The AmazonCognitoIdentityClient type exposes the following members
Constructors
| Name | Description | |
|---|---|---|
|
AmazonCognitoIdentityClient() |
Constructs AmazonCognitoIdentityClient with the credentials loaded from the application's
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
Example App.config with credentials set.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<appSettings>
<add key="AWSProfileName" value="AWS Default"/>
</appSettings>
</configuration>
|
|
|
AmazonCognitoIdentityClient(RegionEndpoint) |
Constructs AmazonCognitoIdentityClient with the credentials loaded from the application's
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
Example App.config with credentials set.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<appSettings>
<add key="AWSProfileName" value="AWS Default"/>
</appSettings>
</configuration>
|
|
|
AmazonCognitoIdentityClient(AmazonCognitoIdentityConfig) |
Constructs AmazonCognitoIdentityClient with the credentials loaded from the application's
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
Example App.config with credentials set.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<appSettings>
<add key="AWSProfileName" value="AWS Default"/>
</appSettings>
</configuration>
|
|
|
AmazonCognitoIdentityClient(AWSCredentials) | Constructs AmazonCognitoIdentityClient with AWS Credentials |
|
|
AmazonCognitoIdentityClient(AWSCredentials, RegionEndpoint) | Constructs AmazonCognitoIdentityClient with AWS Credentials |
|
|
AmazonCognitoIdentityClient(AWSCredentials, AmazonCognitoIdentityConfig) | Constructs AmazonCognitoIdentityClient with AWS Credentials and an AmazonCognitoIdentityClient Configuration object. |
|
|
AmazonCognitoIdentityClient(string, string) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID and AWS Secret Key |
|
|
AmazonCognitoIdentityClient(string, string, RegionEndpoint) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID and AWS Secret Key |
|
|
AmazonCognitoIdentityClient(string, string, AmazonCognitoIdentityConfig) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID, AWS Secret Key and an AmazonCognitoIdentityClient Configuration object. |
|
|
AmazonCognitoIdentityClient(string, string, string) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID and AWS Secret Key |
|
|
AmazonCognitoIdentityClient(string, string, string, RegionEndpoint) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID and AWS Secret Key |
|
|
AmazonCognitoIdentityClient(string, string, string, AmazonCognitoIdentityConfig) | Constructs AmazonCognitoIdentityClient with AWS Access Key ID, AWS Secret Key and an AmazonCognitoIdentityClient Configuration object. |
Methods
| Name | Description | |
|---|---|---|
|
|
BeginCreateIdentityPool(CreateIdentityPoolRequest, AsyncCallback, object) | Initiates the asynchronous execution of the CreateIdentityPool operation. |
|
|
BeginDeleteIdentities(DeleteIdentitiesRequest, AsyncCallback, object) | Initiates the asynchronous execution of the DeleteIdentities operation. |
|
|
BeginDeleteIdentityPool(DeleteIdentityPoolRequest, AsyncCallback, object) | Initiates the asynchronous execution of the DeleteIdentityPool operation. |
|
|
BeginDescribeIdentity(DescribeIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the DescribeIdentity operation. |
|
|
BeginDescribeIdentityPool(DescribeIdentityPoolRequest, AsyncCallback, object) | Initiates the asynchronous execution of the DescribeIdentityPool operation. |
|
|
BeginGetCredentialsForIdentity(GetCredentialsForIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the GetCredentialsForIdentity operation. |
|
|
BeginGetId(GetIdRequest, AsyncCallback, object) | Initiates the asynchronous execution of the GetId operation. |
|
|
BeginGetIdentityPoolRoles(GetIdentityPoolRolesRequest, AsyncCallback, object) | Initiates the asynchronous execution of the GetIdentityPoolRoles operation. |
|
|
BeginGetOpenIdToken(GetOpenIdTokenRequest, AsyncCallback, object) | Initiates the asynchronous execution of the GetOpenIdToken operation. |
|
|
BeginGetOpenIdTokenForDeveloperIdentity(GetOpenIdTokenForDeveloperIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the GetOpenIdTokenForDeveloperIdentity operation. |
|
|
BeginListIdentities(ListIdentitiesRequest, AsyncCallback, object) | Initiates the asynchronous execution of the ListIdentities operation. |
|
|
BeginListIdentityPools(ListIdentityPoolsRequest, AsyncCallback, object) | Initiates the asynchronous execution of the ListIdentityPools operation. |
|
|
BeginLookupDeveloperIdentity(LookupDeveloperIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the LookupDeveloperIdentity operation. |
|
|
BeginMergeDeveloperIdentities(MergeDeveloperIdentitiesRequest, AsyncCallback, object) | Initiates the asynchronous execution of the MergeDeveloperIdentities operation. |
|
|
BeginSetIdentityPoolRoles(SetIdentityPoolRolesRequest, AsyncCallback, object) | Initiates the asynchronous execution of the SetIdentityPoolRoles operation. |
|
|
BeginUnlinkDeveloperIdentity(UnlinkDeveloperIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the UnlinkDeveloperIdentity operation. |
|
|
BeginUnlinkIdentity(UnlinkIdentityRequest, AsyncCallback, object) | Initiates the asynchronous execution of the UnlinkIdentity operation. |
|
|
BeginUpdateIdentityPool(UpdateIdentityPoolRequest, AsyncCallback, object) | Initiates the asynchronous execution of the UpdateIdentityPool operation. |
|
|
CreateIdentityPool(CreateIdentityPoolRequest) |
Creates a new identity pool. The identity pool is a store of user identity information
that is specific to your AWS account. The limit on identity pools is 60 per account.
The keys for SupportedLoginProviders are as follows:
|
|
|
DeleteIdentities(DeleteIdentitiesRequest) |
Deletes identities from an identity pool. You can specify a list of 1-60 identities
that you want to delete.
You must use AWS Developer credentials to call this API. |
|
|
DeleteIdentityPool(string) |
Deletes a user pool. Once a pool is deleted, users will not be able to authenticate
with the pool.
You must use AWS Developer credentials to call this API. |
|
|
DeleteIdentityPool(DeleteIdentityPoolRequest) |
Deletes a user pool. Once a pool is deleted, users will not be able to authenticate
with the pool.
You must use AWS Developer credentials to call this API. |
|
|
DescribeIdentity(string) |
Returns metadata related to the given identity, including when the identity was created
and any associated linked logins.
You must use AWS Developer credentials to call this API. |
|
|
DescribeIdentity(DescribeIdentityRequest) |
Returns metadata related to the given identity, including when the identity was created
and any associated linked logins.
You must use AWS Developer credentials to call this API. |
|
|
DescribeIdentityPool(string) |
Gets details about a particular identity pool, including the pool name, ID description,
creation date, and current number of users.
You must use AWS Developer credentials to call this API. |
|
|
DescribeIdentityPool(DescribeIdentityPoolRequest) |
Gets details about a particular identity pool, including the pool name, ID description,
creation date, and current number of users.
You must use AWS Developer credentials to call this API. |
|
|
Dispose() | Inherited from Amazon.Runtime.AmazonServiceClient. |
|
|
EndCreateIdentityPool(IAsyncResult) | Finishes the asynchronous execution of the CreateIdentityPool operation. |
|
|
EndDeleteIdentities(IAsyncResult) | Finishes the asynchronous execution of the DeleteIdentities operation. |
|
|
EndDeleteIdentityPool(IAsyncResult) | Finishes the asynchronous execution of the DeleteIdentityPool operation. |
|
|
EndDescribeIdentity(IAsyncResult) | Finishes the asynchronous execution of the DescribeIdentity operation. |
|
|
EndDescribeIdentityPool(IAsyncResult) | Finishes the asynchronous execution of the DescribeIdentityPool operation. |
|
|
EndGetCredentialsForIdentity(IAsyncResult) | Finishes the asynchronous execution of the GetCredentialsForIdentity operation. |
|
|
EndGetId(IAsyncResult) | Finishes the asynchronous execution of the GetId operation. |
|
|
EndGetIdentityPoolRoles(IAsyncResult) | Finishes the asynchronous execution of the GetIdentityPoolRoles operation. |
|
|
EndGetOpenIdToken(IAsyncResult) | Finishes the asynchronous execution of the GetOpenIdToken operation. |
|
|
EndGetOpenIdTokenForDeveloperIdentity(IAsyncResult) | Finishes the asynchronous execution of the GetOpenIdTokenForDeveloperIdentity operation. |
|
|
EndListIdentities(IAsyncResult) | Finishes the asynchronous execution of the ListIdentities operation. |
|
|
EndListIdentityPools(IAsyncResult) | Finishes the asynchronous execution of the ListIdentityPools operation. |
|
|
EndLookupDeveloperIdentity(IAsyncResult) | Finishes the asynchronous execution of the LookupDeveloperIdentity operation. |
|
|
EndMergeDeveloperIdentities(IAsyncResult) | Finishes the asynchronous execution of the MergeDeveloperIdentities operation. |
|
|
EndSetIdentityPoolRoles(IAsyncResult) | Finishes the asynchronous execution of the SetIdentityPoolRoles operation. |
|
|
EndUnlinkDeveloperIdentity(IAsyncResult) | Finishes the asynchronous execution of the UnlinkDeveloperIdentity operation. |
|
|
EndUnlinkIdentity(IAsyncResult) | Finishes the asynchronous execution of the UnlinkIdentity operation. |
|
|
EndUpdateIdentityPool(IAsyncResult) | Finishes the asynchronous execution of the UpdateIdentityPool operation. |
|
|
GetCredentialsForIdentity(string) |
Returns credentials for the provided identity ID. Any provided logins will be validated
against supported login providers. If the token is for cognito-identity.amazonaws.com,
it will be passed through to AWS Security Token Service with the appropriate role
for the token.
This is a public API. You do not need any credentials to call this API. |
|
|
GetCredentialsForIdentity(string, Dictionary<String, String>) |
Returns credentials for the provided identity ID. Any provided logins will be validated
against supported login providers. If the token is for cognito-identity.amazonaws.com,
it will be passed through to AWS Security Token Service with the appropriate role
for the token.
This is a public API. You do not need any credentials to call this API. |
|
|
GetCredentialsForIdentity(GetCredentialsForIdentityRequest) |
Returns credentials for the provided identity ID. Any provided logins will be validated
against supported login providers. If the token is for cognito-identity.amazonaws.com,
it will be passed through to AWS Security Token Service with the appropriate role
for the token.
This is a public API. You do not need any credentials to call this API. |
|
|
GetId(GetIdRequest) |
Generates (or retrieves) a Cognito ID. Supplying multiple logins will create an implicit
linked account.
This is a public API. You do not need any credentials to call this API. |
|
|
GetIdentityPoolRoles(string) |
Gets the roles for an identity pool.
You must use AWS Developer credentials to call this API. |
|
|
GetIdentityPoolRoles(GetIdentityPoolRolesRequest) |
Gets the roles for an identity pool.
You must use AWS Developer credentials to call this API. |
|
|
GetOpenIdToken(string) |
Gets an OpenID token, using a known Cognito ID. This known Cognito ID is returned
by GetId. You can optionally add additional logins for the identity. Supplying
multiple logins creates an implicit link.
The OpenId token is valid for 15 minutes. This is a public API. You do not need any credentials to call this API. |
|
|
GetOpenIdToken(GetOpenIdTokenRequest) |
Gets an OpenID token, using a known Cognito ID. This known Cognito ID is returned
by GetId. You can optionally add additional logins for the identity. Supplying
multiple logins creates an implicit link.
The OpenId token is valid for 15 minutes. This is a public API. You do not need any credentials to call this API. |
|
|
GetOpenIdTokenForDeveloperIdentity(GetOpenIdTokenForDeveloperIdentityRequest) |
Registers (or retrieves) a Cognito IdentityId and an OpenID Connect token
for a user authenticated by your backend authentication process. Supplying multiple
logins will create an implicit linked account. You can only specify one developer
provider as part of the Logins map, which is linked to the identity pool.
The developer provider is the "domain" by which Cognito will refer to your users.
You can use You must use AWS Developer credentials to call this API. |
|
|
ListIdentities(ListIdentitiesRequest) |
Lists the identities in a pool.
You must use AWS Developer credentials to call this API. |
|
|
ListIdentityPools(ListIdentityPoolsRequest) |
Lists all of the Cognito identity pools registered for your account.
You must use AWS Developer credentials to call this API. |
|
|
LookupDeveloperIdentity(LookupDeveloperIdentityRequest) |
Retrieves the IdentityID associated with a DeveloperUserIdentifier
or the list of DeveloperUserIdentifiers associated with an IdentityId
for an existing identity. Either IdentityID or DeveloperUserIdentifier
must not be null. If you supply only one of these values, the other value will be
searched in the database and returned as a part of the response. If you supply both,
DeveloperUserIdentifier will be matched against IdentityID.
If the values are verified against the database, the response returns both values
and is the same as the request. Otherwise a ResourceConflictException
is thrown.
You must use AWS Developer credentials to call this API. |
|
|
MergeDeveloperIdentities(MergeDeveloperIdentitiesRequest) |
Merges two users having different IdentityIds, existing in the same identity
pool, and identified by the same developer provider. You can use this action to request
that discrete users be merged and identified as a single user in the Cognito environment.
Cognito associates the given source user (SourceUserIdentifier) with
the IdentityId of the DestinationUserIdentifier. Only developer-authenticated
users can be merged. If the users to be merged are associated with the same public
provider, but as two different users, an exception will be thrown.
You must use AWS Developer credentials to call this API. |
|
|
SetIdentityPoolRoles(string, Dictionary<String, String>) |
Sets the roles for an identity pool. These roles are used when making calls to GetCredentialsForIdentity
action.
You must use AWS Developer credentials to call this API. |
|
|
SetIdentityPoolRoles(SetIdentityPoolRolesRequest) |
Sets the roles for an identity pool. These roles are used when making calls to GetCredentialsForIdentity
action.
You must use AWS Developer credentials to call this API. |
|
|
UnlinkDeveloperIdentity(UnlinkDeveloperIdentityRequest) |
Unlinks a DeveloperUserIdentifier from an existing identity. Unlinked
developer users will be considered new identities next time they are seen. If, for
a given Cognito identity, you remove all federated identities as well as the developer
user identifier, the Cognito identity becomes inaccessible.
You must use AWS Developer credentials to call this API. |
|
|
UnlinkIdentity(UnlinkIdentityRequest) |
Unlinks a federated identity from an existing account. Unlinked logins will be considered
new identities next time they are seen. Removing the last linked login will make this
identity inaccessible.
This is a public API. You do not need any credentials to call this API. |
|
|
UpdateIdentityPool(UpdateIdentityPoolRequest) |
Updates a user pool.
You must use AWS Developer credentials to call this API. |
Events
| Name | Description | |
|---|---|---|
|
|
AfterResponseEvent | Inherited from Amazon.Runtime.AmazonServiceClient. |
|
|
BeforeRequestEvent | Inherited from Amazon.Runtime.AmazonServiceClient. |
|
|
ExceptionEvent | Inherited from Amazon.Runtime.AmazonServiceClient. |
Version Information
.NET Framework:
Supported in: 4.5, 4.0, 3.5
.NET for Windows Store apps:
Supported in: Windows 8.1, Windows 8
.NET for Windows Phone:
Supported in: Windows Phone 8.1, Windows Phone 8