Sign in to Amazon Cognito

You can add EntryIdP to an Amazon Cognito user pool as an identity provider, so that people sign in to your Cognito apps with an EntryIdP face scan. No code is involved: Cognito's OpenID Connect identity provider works with any OpenID Connect provider, and EntryIdP is one.

You'll need about 20 minutes, an EntryIdP tenant administrator, and someone who can change the user pool in the AWS console.

How it works

1. Someone selects EntryIdP on your Cognito sign-in page.
2. Cognito sends them to EntryIdP. They do a face scan, and EntryIdP finds their account.
3. Cognito reads their email address from EntryIdP, creates a user for them in the pool the first time, and signs them in to your app.

Before you start

• [ ] You can edit the user pool, and it has a domain for its sign-in pages.
• [ ] Each person who will use it has an EntryIdP account, made at {issuer}/me with Create Entry Account.
• [ ] Each of them has verified their email in EntryIdP. EntryIdP releases an email only once it is verified, and Cognito needs one if your pool requires an email.

Cognito never asks EntryIdP to create an account, so a person with no EntryIdP account can't get through.

Step 1: Register Cognito as an app in EntryIdP

In your tenant's admin portal ({issuer}/tenant), add a new app:

Setting	Value
Name	The name of your Cognito app
Type	Confidential (it has a client secret)
Scopes	openid profile
Redirect URI	https://{your user pool domain}/oauth2/idpresponse, for example https://acme.auth.eu-west-2.amazoncognito.com/oauth2/idpresponse
Allow sign-in without PKCE	On

Copy the client ID and client secret. The secret is shown only once.

Why PKCE has to be off

Cognito doesn't send PKCE to an OpenID Connect provider, and has no setting to make it. EntryIdP normally refuses any sign-in without PKCE, so this app must allow it. Your app still proves who it is with its client secret, and the setting applies to this app only. Leave it off for every other app.

Limit who can use it

Turn on Require access approval for this app. Only people you approve can then sign in through it.

Step 2: Add EntryIdP to the user pool

In the AWS console, open the user pool:

1. Go to Authentication → Social and external providers, select Add identity provider, then OpenID Connect (OIDC).

2. Fill in:

   Field	Value
   Provider name	EntryIdP
   Client ID	From step 1
   Client secret	From step 1
   Authorized scopes	openid profile. Don't add email: EntryIdP refuses any scope it doesn't know.
   Attribute request method	GET
   Setup method	Manual input
   Issuer URL	{issuer}, with no trailing /
   Authorization endpoint	{issuer}/authorize
   Token endpoint	{issuer}/token
   UserInfo endpoint	{issuer}/userinfo
   Jwks_uri	{issuer}/.well-known/jwks.json

3. Under Map attributes, map the user pool attribute email to the OpenID Connect attribute email. Map every other attribute your pool requires as well, or Cognito can't create the user.

4. Save.

Use Manual input. In our test, Cognito's Auto fill through issuer URL made every sign-in fail with "Unsupported configuration for OIDC Identity Provider", before Cognito ever contacted EntryIdP.

Your issuer is https://idp.entryidp.com on Production. See How it works for the other environments.

Step 3: Turn it on for your app client

Still in the user pool, go to Applications → App clients, open your app client, and edit its Login pages:

1. Under Identity providers, add EntryIdP.
2. Make sure Authorization code grant is selected, with the openid scope.
3. Save.

Your Cognito sign-in page now shows an EntryIdP button. To skip that page and go straight to EntryIdP, add identity_provider=EntryIdP to your app's Cognito /oauth2/authorize URL.

Step 4: Test

Use a private browser window for each test.

Test	Expected result
A person with a verified EntryIdP email selects EntryIdP	Face scan, then back in your app, signed in
The same person a second time	Face scan, then signed in as the same Cognito user
A person whose EntryIdP email isn't verified	Face scan, then a Cognito error, if your pool requires an email
A person with no EntryIdP account	Face scan, then an error returned to your app: EntryIdP doesn't know their face

In our test, the whole sign-in took about 18 seconds, including the face scan. Cognito gives up on a sign-in that takes longer than 5 minutes.

Troubleshooting

What the person sees	Likely cause	What to do
Your app receives error_description=Unsupported configuration for OIDC Identity Provider	Cognito set the provider up from the issuer URL	Switch the setup method to Manual input (step 2)
An EntryIdP error: "The mandatory 'code_challenge' parameter is missing" or "code_challenge is required"	The EntryIdP app doesn't allow sign-in without PKCE	Turn on Allow sign-in without PKCE (step 1)
An EntryIdP error that the scope is invalid	Cognito is asking for email or another scope EntryIdP doesn't know	Set Authorized scopes to openid profile
An EntryIdP error about the redirect URI	The app's redirect URI doesn't match your pool's domain	Copy it again, ending in /oauth2/idpresponse
A Cognito error about a missing attribute	The person's EntryIdP email isn't verified, or a required attribute isn't mapped	They verify their email at {issuer}/me; check your mappings (step 2)

Turn it off

Remove EntryIdP from your app client's identity providers. Nothing needs to change in EntryIdP.

Good to know

• Cognito creates its own user for each person the first time they sign in through EntryIdP. It does not join them to an existing user in the pool with the same email. Linking the two needs Cognito's AdminLinkProviderForUser, usually from a pre sign-up Lambda trigger.
• Cognito reads the email from EntryIdP's userinfo endpoint, not from the ID token, which carries no email or name.

See AWS's own guide: Using OIDC identity providers with a user pool.