cognito.yml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  CognitoDomain:
    Type: String
    Description: subdomain portion of the cognito domain
  CustomResourceStackName:
    Type: String
    Description: stack name where custom resource lambda arns are exported from
    Default: ""
  CallbackURLs:
    Type: CommaDelimitedList
    Description: A list of callback URLs (e.g. for each environment) for Cognito user pool settings
  LogoutURLs:
    Type: CommaDelimitedList
    Description: A list of Logout URLs (e.g. for each environment) for Cognito user pool settings
  ManifestPresent:
    Type: String
    Description: Boolean value of whether manifest from Azure has been received and deployed
    Default: "true"
  LoadBalancerListenerArn:
    Type: String
    Description: ARN of your ALB listener (must be HTTPS protocol to authenticate with Cognito in load balancer)    
    Default: ""
Conditions:
  HaveManifest: 
    Fn::Equals: ["true", !Ref ManifestPresent]
  HaveLoadBalancer:
    Fn::Not: 
      - Fn::Equals: ["", !Ref LoadBalancerListenerArn]

Resources:  
  ClientUserPool:
    Type: "AWS::Cognito::UserPool"
    Properties:
      UserPoolName: !Sub "${CognitoDomain}-client-user-pool"
      Schema:
        - Name: name
          AttributeDataType: String
          Mutable: true
          Required: true
        - Name: email
          AttributeDataType: String
          Mutable: true
          Required: true
        - Name: groups
          AttributeDataType: String
          Mutable: true
          Required: false
      UsernameAttributes:
        - email

  ClientUserPoolClient:
    Type: "AWS::Cognito::UserPoolClient"
    Properties:
      ClientName: !Sub "${CognitoDomain}-client-user-pool-client"
      GenerateSecret: true
      UserPoolId: !Ref ClientUserPool

  UserPoolClientSettings:
    Type: 'Custom::CognitoUserPoolClientSettings' 
    Properties:
      ServiceToken: 
        Fn::ImportValue: !Sub "${CustomResourceStackName}CustomUserPoolClientSettingsArn"
      UserPoolId: !Ref ClientUserPool
      UserPoolClientId: !Ref ClientUserPoolClient
      SupportedIdentityProviders: 
        - Fn::If:
            - HaveManifest
            - !Ref UserPoolIdentityProvider
            - !Ref AWS::NoValue
      CallbackURLs: !Ref CallbackURLs
      LogoutURLs: !Ref LogoutURLs
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthFlows:
        - code
        - implicit
      AllowedOAuthScopes:
        - openid
        - email

  UserPoolDomain:
    Type: 'Custom::CognitoUserPoolDomain'
    Properties:
      ServiceToken: 
        Fn::ImportValue: !Sub "${CustomResourceStackName}CustomUserPoolDomainArn"
      UserPoolId: !Ref ClientUserPool
      Domain: !Ref CognitoDomain
      RandomParam: 1

  UserPoolResourceServer:
    Type: 'Custom::CognitoUserPoolResourceServer'
    Properties:
      ServiceToken: 
        Fn::ImportValue: !Sub "${CustomResourceStackName}CustomUserPoolResourceServerArn"
      ResourceServer:
        UserPoolId:
            !Ref ClientUserPool
        Identifier: !Sub "https://${CognitoDomain}.yoursite.com"
        Name: !Ref CognitoDomain
        Scopes:
          - ScopeName: customscope
            ScopeDescription: your own custom scopes

  UserPoolIdentityProvider:
    Type: 'Custom::CognitoUserPoolIdentityProvider'
    Condition: HaveManifest
    Properties:
      ServiceToken:
        Fn::ImportValue: !Sub "${CustomResourceStackName}CustomUserPoolIdentProvArn"
      MetadataFile:
        !Sub "${CognitoDomain}.xml"
      ProviderName:
        AzureSSO
      UserPoolId:
        !Ref ClientUserPool
      AttributeMapping:
        name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
        email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
        groups: http://schemas.microsoft.com/ws/2008/06/identity/claims/groups


  LoadBalancerListenerRuleCognito:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Condition: HaveLoadBalancer
    Properties:
      ListenerArn:
        Fn::ImportValue: !Ref LoadBalancerListenerArn
      Conditions:
        - Field: path-pattern
          Values:
            - "*"
      Priority: 120
      Actions:
        - AuthenticateCognitoConfig:
            OnUnauthenticatedRequest: authenticate
            SessionCookieName: AWSELBAuthSessionCookie
            UserPoolArn: !GetAtt ClientUserPool.Arn
            UserPoolClientId: !Ref ClientUserPoolClient
            UserPoolDomain: !Ref CognitoDomain
          Type: authenticate-cognito
          Order: 10
        - Type: fixed-response 
          FixedResponseConfig: 
            ContentType: text/plain 
            MessageBody: "Congratulations! Authenticated." 
            StatusCode: "200" 
          Order: 20
Outputs:
  UserPoolDomain:
    Value: !Ref CognitoDomain
    Export:
      Name: !Sub "${AWS::StackName}UserPoolDomain"
  UserPoolArn:
    Value: !GetAtt ClientUserPool.Arn
    Export:
      Name: !Sub "${AWS::StackName}UserPoolArn"
  UserPoolClientId:
    Value: !Ref ClientUserPoolClient
    Export:
      Name: !Sub "${AWS::StackName}UserPoolClientId"