Authorization always fails with 404 about aws-aspnet-cognito-identity-provider HOT 6 CLOSED

Me too! I found that this code is all that you need for the [Authorize] attribute to work as expected.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
    options.Audience =  // UserPoolClientId
    options.Authority = // https://cognito-idp.<Region>.amazonaws.com/<UserPoolId>
});

from aws-aspnet-cognito-identity-provider.

Me too! I found that this code is all that you need for the [Authorize] attribute to work as expected.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
    options.Audience =  // UserPoolClientId
    options.Authority = // https://cognito-idp.<Region>.amazonaws.com/<UserPoolId>
});

Thanks for the information. I'm not quite sure if this really solves the described problem. I think you can even remove the line services.AddCognitoIdentity(); completely and your solution would still work. It's just the standard implementation of an JWT bearer token for authentication/authorization. Can you use the cognito-specific features, such as [Authorize(Roles = "Admin")] with you solution?

from aws-aspnet-cognito-identity-provider.

I am also having the same problem.

from aws-aspnet-cognito-identity-provider.

I am also having the same problem

from aws-aspnet-cognito-identity-provider.

Hi @jochencschmidt,

I came across the useful article ASP.NET Core with AWS Lambda and Cognito which might be useful for configuring Cognito Group based authorization in an ASP.NET Core application. It has a section Groups and Policies which provides the following details to add a custom policy.

You can use [Authorize] to ensure that only logged-in users can access the Page/Controller/Route. However you’d probably like more fine-grained control, so for that you can add users to Cognito Groups. On the ASP.NET Core app, those groups are sent as part of the user Claims. You can create authorization polices during the Startup.Configure method as follows:

services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
    policy.RequireAssertion(context =>
    context.User.HasClaim(c => c.Type == "cognito:groups" && c.Value == "Admin")));
});

This creates a policy requiring the logged in user to be part of the Cognito group Admin. To use this on a Page/Controller/Route, refer to the policy name in the Authorize attribute:

[Authorize(Policy = "AdminOnly")]

Article Now generally available: the ASP.NET Core Identity Provider for Amazon Cognito also provides similar guidance.

Please let me know if this helps and let me know if this issue could be closed.

Thanks,
Ashish

from aws-aspnet-cognito-identity-provider.

This issue has not recieved a response in 2 weeks. If you want to keep this issue open, please just leave a comment below and auto-close will be canceled.

from aws-aspnet-cognito-identity-provider.