search

aws-amplify / amplify-backend

Home to all tools related to Amplify's code-first DX (Gen 2) for building fullstack apps on AWS
Apache License 2.0
158 stars 54 forks source link

RFC: Use existing auth resources with `referenceAuth` #1548

Open josefaidt opened 3 months ago

josefaidt commented 3 months ago

Hey folks :wave: we’re looking to introduce a mechanism to consume existing auth resources, and use with other Amplify resources like Data without additional configuration or the need for patching with CDK. This mechanism aims to address the following use cases:

Similar to the define* terminology, we are looking to introduce reference* terminology in an effort to convey which resources are defined and managed by the Amplify app, and resources that are simply referenced to use with other Amplify resources. Unlike defined resources, referenced resources cannot be modified. For example, when referencing existing auth resources you will not be able to add additional identity providers unique to your app, or add additional/custom attributes to the user pool schema.

// amplify/auth/resource.ts
import { referenceAuth } from "@aws-amplify/backend"

export const auth = referenceAuth({
  userPoolId: "...",
  userPoolClientId: "...",
  identityPoolId: "...",
  authenticatedRoleName: "...",
  unauthenticatedRoleName: "...",
})

At a high level the following constraints exist with referenceAuth:

The props shape may change, but we’re curious to hear your thoughts and whether this addresses your use case!

pfj3 commented 3 months ago

This would be a huge help!

asmajlovicmars commented 1 month ago

This would be essential for us to migrate a large Gen 1 application to Gen 2. The idea is to keep the existing authentication, rebuild the data models, and eventually migrate everything else from CDK to Amplify. It's also important to mention that we want to use referenced authentication for data authorization on both new and existing data models; otherwise, there's no point in having a referenced Cognito Pool.

taoatmars commented 1 month ago

I been trying to follow the documentation to connect to our existing Auth and wonder why it doesn't work with other resources. looks like this is the solution for it.

caioquirino commented 1 month ago

Hi @taoatmars although this looks acceptable, the other generated Metadata and resources does not recognize the configured auth, so as soon as you start integrating your data modeling with auth, you will start getting errors related to some Metadata that should be available but for some reason it is not.

It would be great also to be able to configure the project to reuse a single cognito user pool across all branches and sandboxes.

taoatmars commented 1 month ago

@caioquirino This is great insight, and thank you for stopping me diving into some rabbit hole. This has made it very difficult for us to migrate from amplify v1 to v2.

luunminh commented 3 weeks ago

really need this one ASAP

mariasemionova commented 2 weeks ago

I am sorry if it is out of scope of this thread. But I didn't find anything more related to my question: Is there a way to use a single "aws-amplify/auth" configuration across multiple microfrontend apps?

I have a monorepo (Turborepo managed with pnpm) where all authentication logic is centralized in the main app. The other apps function as subpaths of the main app, facilitated by Next.js rewrites (NextJS 14 App Router). However, when I navigate to a subapp, it seems that the "aws-amplify/auth" context is lost.

I'm trying to run Amplify.configure(amplify_outputs) with the same configuration in all subapps as early as possible (root layout). I was hoping this would allow it to recognize session data from Cognito cookies, which are accessible to the subapps.

However, when I call "fetchAuthSession()" from "aws-amplify/auth", it returns no data, indicating that the user is unauthenticated.

Does anyone know of an example of a similar setup or have suggestions on how to resolve this?

gsi-chao commented 1 week ago

Any news on this feature? I need to create an Amplify app that uses an existing Cognito and adds some maps with policies attached to it. Currently, it’s impossible for me to do so using the existing documentation.