AWS Cognito is a connector from Amazon Web Services that helps developers build web and mobile apps that are more secure. It helps to better authenticate users. It also handles user data, including passwords, token-based authentication, scalability, permissions, and so on.

Supervisor configuration parameters

To configure the connector, following parameters are required:

• Connector name

• AccessKey Id

• Access Secret

• Region

• User Pool Id

• Target URL (Cloud application's instance URL used as target URI in payload)

• Instance DateTime Offset (refer Configuring additional datetime offset in connectors for more details).

Users

Table 208: Supported operations for Users

Operation	VERB
Create User	POST
Update User	PUT
Delete User	DELETE
Get User	GET
Get All Users	GET
Get All Users with Pagination	GET

Groups

Table 209: Supported operations for Groups

Operation	VERB
Create Group	POST
Update Group	PUT
Delete Group	DELETE
Get Group	GET
Get All Groups	GET
Get All Users with Pagination	GET
Update Membership	PUT

Mandatory fields

Users

• Username

• Email

Groups

DisplayName

User and Group mapping

The user and group mappings are listed in the tables below.

Table 210: User mapping

SCIM parameter	AWS Cognito parameter
Id	Username
userName	Username
Name.Formatted	Username
DisplayName	Username
Emails[0].value	UserAttributes.email
Active	UserStatus.CONFIRMED
PhoneNumbers[0].Value	phone_number
Password	Password
Extension.IsPasswordPermanent	Permanent
Extension.DesiredDeliveryMediums	DesiredDeliveryMediums
Extension.email_verified	UserAttributes.email_verified
Extension.phone_number_verified	UserAttributes.phone_number_verified
Created_at	UserCreateDate
lastModified_at	UserLastModifiedDate

Groups

Table 211: Group mapping

SCIM parameter	AWS Cognito parameter
Id	GroupName
displayName	GroupName
members[].value	Users[].Username
members[].display	Users[].Username
Extension.Precedence	Precedence
Extension.RoleArn	RoleArn
Created_at	CreationDate
lastModified_at	LastModifiedDate

Connector limitations

• Creating or updating the User or a Group happens in multiple steps. Failure in any step is reported as a complete failure of operation. However, the record is persisted until succeeded steps.

• Noncompliance to password policy returns an error. However, an User is created.

• DesiredDeliveredMedium is write only property. By default, SMS is the default option and it is not returned in Get specific user response.

• A User can be a member of a maximum of 25 groups.