Webiny Cognito Federation
Configuring Cognito Federation for Webiny projects, federated sign-in via external...
Install
npx skills add webiny/webiny-js --skill webiny-cognito-federation -g -a claude-code -y- Repository
- webiny/webiny-js8.1k
- Category
- Engineering
- Updated
- 5d ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Configuring Cognito Federation for Webiny projects, federated sign-in via external identity providers (Google, Facebook, Apple, Amazon, OIDC/Entra ID) while keeping Cognito as the user pool. Use this skill when the developer asks about Cognito federation, SSO with Cognito, adding Google/Microsoft/OIDC login to Cognito, federated identity providers, CognitoSignInConfig, CognitoIdpConfig, external users, signInWithRedirect, OAuth redirect URLs, hiding the password form, allowCredentialsLogin, or customizing the federated login screen.
Cognito Federation
TL;DR
Webiny supports federated sign-in through Cognito, users authenticate via external identity providers (Google, Entra ID, etc.) while Cognito remains the user pool. Configure it by adding a federation prop to <Cognito /> in webiny.config.tsx. This handles both infrastructure (Cognito User Pool Domain, IdP resources, OAuth client) and the admin login screen (provider buttons, OAuth for Amplify). Federated users are auto-detected and synced into Webiny. For advanced use cases, provide apiConfig (custom identity mapping) and/or adminConfig (custom login screen behavior).
Pattern / Core Concept
Cognito Federation has three layers:
-
Infrastructure, The
federationprop on<Cognito />, under the hood, creates the Cognito User Pool Domain, Identity Provider resources, and configures OAuth on the User Pool Client. -
Admin Login Screen, The federation config is passed as an
Admin.BuildParamto the admin app. ACognitoSignInConfigabstraction provides the login screen with provider buttons, OAuth settings for Amplify, and credentials visibility. By default, this is auto-generated from thefederationprop. For advanced customization (IP whitelists, async logic), provide anadminConfigextension. -
API Identity, Federated tokens are auto-detected via the
identitiesJWT claim and markedexternal: true. TheExternalIdpUserSyncHandlerauto-creates/updates users on login. For custom role/team mapping, provide anapiConfigextension implementingCognitoIdpConfig.
