Enabling sign-in with social identity providers like Facebook or Google

Question

Pulumi · Accepted Answer

To enable sign-in with social identity providers such as Facebook or Google, you will need to use a service that supports OAuth authentication. A common way to accomplish this in the cloud is using AWS Cognito, which allows you to create a user pool that can integrate with these social identity providers.

Below you will find a Pulumi program written in TypeScript. This program will set up an AWS Cognito User Pool and User Pool Client that are configured to allow users to sign in using their Facebook or Google credentials. The integration works by setting the supported identity providers for the Cognito User Pool Client, and specifying the details via an Identity Provider configuration.

AWS Cognito is chosen because it is a secure and scalable service which provides users with a seamless authentication experience, reusable across multiple applications.

First, let's walk through what the program does:

Cognito User Pool: Creates a new user pool in AWS Cognito. This user pool will manage user registration, authentication, account recovery, and other operations.
Cognito User Pool Client: Creates an application client within the user pool that will be used by your application to authenticate users.
Cognito Identity Providers: Sets up identity providers in the user pool. This is where you would configure the details for Facebook and Google, such as client ID and client secret obtained from the OAuth providers.

Here's the TypeScript program for Pulumi that sets up AWS Cognito with Facebook and Google as identity providers:

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// AWS Cognito User Pool
const userPool = new aws.cognito.UserPool("my-user-pool", {
    schemas: [{
        name: "email",
        attributeDataType: "String",
        required: true,
        mutable: true,
    }],
    autoVerifiedAttributes: ["email"],
});

// AWS Cognito User Pool Client
const userPoolClient = new aws.cognito.UserPoolClient("my-user-pool-client", {
    userPoolId: userPool.id,
    callbackUrls: ["https://www.example.com/callback"],
    logoutUrls: ["https://www.example.com/logout"],
    allowedOauthFlows: ["implicit", "code"],
    allowedOauthScopes: ["openid", "email"],
    supportedIdentityProviders: ["Facebook", "Google"],
    // Generate the client secret - it is required for social identity providers
    generateSecret: true,
});

// You must create and configure these identity providers on the respective platforms:
// Google Developer Console - https://console.developers.google.com/
// Facebook Developer Console - https://developers.facebook.com/

/* 
This code is commented out because it assumes you've already configured Identity Providers on these platforms.
After configuration, you can then pass the obtained details to AWS Cognito as follows:

const fbIdentityProvider = new aws.cognito.IdentityProvider("facebook", {
    userPoolId: userPool.id,
    providerName: "Facebook", // This specifies the identity provider name.
    providerType: "Facebook", // This specifies the type of the identity provider.
    providerDetails: {
        // The details from the Facebook app - replace with your actual values
        client_id: "<Facebook-App-Client-Id>",
        client_secret: "<Facebook-App-Client-Secret>",
        authorize_scopes: "email,public_profile",
    },
    attributeMapping: {
        email: "email",
        username: "id",
    },
});

const googleIdentityProvider = new aws.cognito.IdentityProvider("google", {
    userPoolId: userPool.id,
    providerName: "Google", // This specifies the identity provider name.
    providerType: "Google", // This specifies the type of the identity provider.
    providerDetails: {
        // The details from the Google app - replace with your actual values
        client_id: "<Google-App-Client-Id>",
        client_secret: "<Google-App-Client-Secret>",
        authorize_scopes: "openid email",
    },
    attributeMapping: {
        email: "email",
        username: "sub",
    },
});
*/

// Export the important URLs to be used in your application configuration.
export const userPoolId = userPool.id;
export const userPoolClientId = userPoolClient.id;
export const userPoolClientSecret = userPoolClient.clientSecret; // Be careful with this secret!

This code sets up the basic structure without actually creating the identity providers (commented out section). To have a fully functional login system using Facebook or Google as identity providers, you will need to create applications in the Facebook and Google developer consoles, respectively. There, you will receive the necessary client ID and client secret to configure the identity providers in AWS Cognito.

Remember, the client secret is sensitive information, and you need to handle it securely, ensuring that it is not exposed publicly or to unauthorized users.

To apply this Pulumi code, you must have the @pulumi/aws package installed and AWS CLI configured with the necessary permissions to create these resources. You can install the required Pulumi package using npm or yarn:

npm install @pulumi/aws

or

yarn add @pulumi/aws

Once the Identity Providers are implemented correctly in the AWS Console, users will be able to sign in to your application using their Facebook or Google credentials, and their identities will be managed by AWS Cognito.