View source for OIDC SSO Amazon Cognito Testing Steps


== Create user pool ==
Amazon Cognito <nowiki>https://console.aws.amazon.com/cognito/home</nowiki> > User pools > Create user pool

=== Step 1: Select Cognito user pool provider type ===
[[File:Amazon Cognito Testing Step 1.png]]

=== Step 2: Configure password and authentication policy ===

=== [[File:Amazon Cognito Testing Step 2.png]] ===

=== Step 3: Configure sign-up experience ===
[[File:Amazon Cognito Testing Step 3.png]]

=== Step 4: Configure email and SMS delivery ===
[[File:Amazon Cognito Testing Step 4.png]]

=== Step 5: Integrate app ===

==== Step 5.1: Setup integration with app ====
[[File:Amazon Cognito Testing Step 5 1.png]]

==== Step 5.2: Setup Cognito domain ====
[[File:Amazon Cognito Testing Step 5 2.png]]

==== Step 5.3: Select Confidential client, enter app client name and select Generate a client secret ====
[[File:Amazon Cognito Testing Step 5 3.png]]

==== Step 5.4: Enter callback URLs ====
[[File:Amazon Cognito Testing Step 5 4.png]]

==== Step 5.5: Add ALLOW_USER_PASSWORD_AUTH to Authentication flows ====
[[File:Amazon Cognito Testing Step 5 5.png]]

==== Step 5.6: Add Profile to Open ID Connect scopes ====
[[File:Amazon Cognito Testing Step 5 6.png]]

== User pool configuration ==

=== Step 1: Create user ===
User pool: GardenWorld > Users > Create user

''Notes:'' 

* ''User name = iDempiere user (AD_User.Name)''
* ''Email address = iDempiere user (AD_User.EMail)''
* ''User has to login for the first time using the temporary password to change new password''

[[File:Amazon Cognito Testing User Pool Step 1.png]]

=== Step 2: Create group ===
User pool: GardenWorld > Groups > Create group

''Note: Group name = iDempiere role (AD_Role.Name) without space''

[[File:Amazon Cognito Testing User Pool Step 2.png]]

=== Step 3: Add user to group ===
User pool: GardenWorld > Groups > Group: GardenWorldAdmin > Add user to group

[[File:Amazon Cognito Testing User Pool Step 3.png]]

=== Step 4: Get region, User pool ID, Client ID, Client secret, Domain and Allowed callback URLs ===

==== Step 4.1: Copy region and User pool ID ====
User pool: GardenWorld > App integration

Get the region from the Token signing key URL. Token signing key URL format - <nowiki>https://cognito-idp</nowiki>.[region].amazonaws.com/[userPoolId]/.well-known/jwks.json.

Copy the User pool ID

[[File:Amazon Cognito Testing User Pool Step 4 1.png]]

==== Step 4.2: Copy Client ID and Client secret ====
User pool: GardenWorld > App integration > App client: iDempiere Web Client

Copy the Client ID and Client secret

[[File:Amazon Cognito Testing User Pool Step 4 2.png]]

==== Step 4.3: Copy Domain ====
''Note: Cognito domain is required for Authorization Code Grant authorization flow''

User pool: GardenWorld > App integration > Domain

Copy Domain

[[File:Amazon Cognito Testing User Pool Step 4 3.png]]

==== Step 4.4: Copy Allowed callback URLs and Hosted UI link address ====
''Note: Allowed callback URL is required for Authorization Code Grant authorization flow''

User pool: GardenWorld > App integration > App client: iDempiere Web Client > Hosted UI

Copy Allowed callback URLs

Right-click on the View Hosted UI button to Copy link address

[[File:Amazon Cognito Testing User Pool Step 4 4.png]]

=== Step 5: Pre Token Generation Lambda trigger (Optional) ===
User attributes such as email, phone number etc are included in the ID Token instead of Access Token. 

You have to set up a Pre Token Generation Lambda trigger to add custom claims (such as user email, phone number etc) to the Access Token. Customization of Access Token requires user to turn on the Advanced security features.

== Rest OpenID Connect Service configuration ==
iDempiere Web Client > Tenant: GardenWorld > Rest OpenID Connect Service

Authority URL format - <nowiki>https://cognito-idp</nowiki>.[region].amazonaws.com/[userPoolId]

Audience - User pool: GardenWorld > App integration > App client: iDempiere Web Client > Client ID

[[File:Amazon Cognito Testing Rest OpenID Connect Service.png]]

== Generate Secret Hash ==
''Note: Secret Hash is required for Resource Owner Password Credentials (ROPC) authorization flow''

* Combine the User name and Client ID into a single string
* Hash the combined string using the HMAC-SHA256 algorithm and the client secret as the key
* Base64 encode the resulting hash

== Testing using Postman ==

* Import amazon-cognito-oidc-test.postman_collection.json and environment-http---localhost-8080.postman_environment.json to Postman
* Set variable value
** cognitoDomain - Get Domain value from User pool configuration > Step 4.3 (for Authorization Code Grant flow only)
** cognitoRegion - Get region value from User pool configuration > Step 4.1
** cognitoClientId - Get Client ID value from User pool configuration > Step 4.1
** cognitoSecret - Get Client secret value from User pool configuration > Step 4.1 
** cognitoRedirectUri - Get Allowed callback URL from User pool configuration > Step 4.4 (for Authorization Code Grant flow only)
** cognitoUsername - User name of User pool: GardenWorld > Users > User: GardenAdmin (for Resource Owner Password Credentials flow only)
** cognitoPassword - Password of User pool: GardenWorld > Users > User: GardenAdmin (for Resource Owner Password Credentials flow only)
** cognitoSecretHash - Get the generated secret hash from Generate Secret Hash (for Resource Owner Password Credentials flow only)

=== Step 1: Get and Refresh Token ===
There are two authentication flows used to get token and refresh token: Authorization Code Grant and Resource Owner Password Credentials (ROPC).

For ROPC flow, the access token is not openid scope, therefore cannot be used to access the endpoints return from well known configuration url.

==== Step 1.1: Authorization Code Grant ====

===== Step 1.1.1: Get Code =====
Get the Hosted UI link address (i.e. Authorization URL) from User pool configuration > Step 4.4

Authorization URL format - [cognitoDomain]/oauth2/authorize?client_id=[cognitoClientId]&response_type=code&scope=email+openid+profile&redirect_uri=[cognitoRedirectUri]

When the user accesses the Authorization URL, they will be prompted to log in. After logging in and granting permissions, Cognito will redirect them to the redirect_uri with an authorization code.

Redirect format - [cognitoRedirectUri]?code=[authorizationCode]

===== Step 1.1.2: Get Token =====
Enter the [authorizationCode] from Step 1.2.1: Get Code to the code value

[[File:Amazon Cognito Testing Postman Step 1 1 2.png]]

===== Step 1.1.3: Refresh Token =====
[[File:Amazon Cognito Testing Postman Step 1 1 3.png]]

==== Step 1.2: Resource Owner Password Credentials (ROPC) ====

===== Step 1.2.1: Get Token =====
[[File:Amazon Cognito Testing Postman Step 1 2 1.png]]

===== Step 1.2.2: Refresh Token =====
[[File:Amazon Cognito Testing Postman Step 1 2 2.png]]

=== Step 2: Sample REST requests ===

==== Step 2.1: Get tax records where C_TaxCategory_ID=107 ====
''Notes:'' 

* ''X-ID-IdToken is required if iDempiere is configured to use email to login and email information is not included in the Access Token (for Resource Owner Password Credentials flow only)''
* ''X-ID-Role is required if user has more than one role access''
* ''X-ID-Organization is required if user + role has more than one organization access''

[[File:Amazon Cognito Testing Postman Step 2 1.png]]

==== Step 2.2: Get document no and description of the order records ====
''Notes:'' 

* ''X-ID-IdToken is required if iDempiere is configured to use email to login and email information is not included in the Access Token (for Resource Owner Password Credentials flow only)''
* ''X-ID-Role is required if user has more than one role access''
* ''X-ID-Organization is required if user + role has more than one organization access''

[[File:Amazon Cognito Testing Postman Step 2 2.png]]