search

aws-amplify / amplify-category-api

The AWS Amplify CLI is a toolchain for simplifying serverless web and mobile development. This plugin provides functionality for the API category, allowing for the creation and management of GraphQL and REST based backends for your amplify project.
https://docs.amplify.aws/
Apache License 2.0
89 stars 79 forks source link

@auth must allow authentication against custom claims in Cognito User Pool #399

Open pspanchal opened 5 years ago

pspanchal commented 5 years ago

Is your feature request related to a problem? Please describe. I need to authorize a custom claim (example tenantID for multi-tenant app) in addition to group ownership in @auth directive.

Describe the solution you'd like Please allow custom claim to be validated against a field in the dynamoDB table for @auth directive. This is very similar to @group ownership directive.

Describe alternatives you've considered If I have a lot of tenants each with a number of groups - read-only, admin, root, power-users etc... then 1 alternative was to treat tenantID+group as a different group. But this would be too many combinations of groups and will quickly hit the hard limit of groups for the cognito User pool. The other option is to write a pipeline resolver just for this purpose. But this is also not ideal and need a declarative method of authorization against any custom claims as possible. Hence the suggested solution.

Additional context Reinvent 2018 talks of Multi-tenant SaaS to build good isolation down to data layer

RossWilliams commented 5 years ago

Owner permissions currently allow specifying an arbitrary claim by using the 'identityField' parameter. If you want to process a claim that holds an array of strings, a current option is to add more items to the 'cognito:groups' claim using a Cognito Pre-Token Lambda. The documentation shows group modifications here. I do not use this myself, but I don't think its subject to limits of Cognito-managed groups.

Lastly, I have also requested this feature as well and currently have this implemented in a fork. A patch file you can use is attached to aws-amplify/amplify-category-api#403.

pspanchal commented 5 years ago

Thanks @RossWilliams. Is there documentation for the identityField parameter?

At a quick glance, the Pre-Token feels like a band-aid to the problem and can only go so far.

I am a bit unclear how to use the patch file and fork that you have pointed out. Any reason why it has not been incorporated in the main branch. Are there other design considerations

RossWilliams commented 5 years ago

It’s not well explained in the documentation, but if you create a test schema and inspect the generated templates it should be clearer.

The patch file is a git patch file, just with a different extension. Adding it into the repo needs someone to do the work for tests and documentation.