Cognito Identity Provider Setup

Configure Google identity provider in Cognito with OAuth credentials.

What It Does

Updates the placeholder Google identity provider created by CDK with real OAuth credentials collected from GCP setup. This enables Google social login for user authentication.

Note: Microsoft authentication is handled directly by the application (not via Cognito) due to Cognito's strict issuer validation rejecting Microsoft's multi-tenant tokens. See outlook-setup.md for Microsoft OAuth configuration.

When to Run

After:

Before:

Prerequisites

Steps

cd /home/volrath/code/orcha/orcha/infra

# Default: reads credentials from SSM
./scripts/setup-cognito-idps.sh --profile orcha-prod

# Dry run (show what would be updated)
./scripts/setup-cognito-idps.sh --profile orcha-prod --dry-run

The script reads credentials from SSM and updates the Cognito Google identity provider.

Option B: AWS Console (Manual)

  1. Open AWS Console - Cognito
  2. Select v1-orcha-user-pool
  3. Go to Sign-in experience tab
  4. Under Federated identity provider sign-in, click Google
  5. Click Edit and enter:

Verify

# Verify Google IdP is configured (should show real client ID, not placeholder)
aws cognito-idp describe-identity-provider \
    --profile orcha-prod \
    --region eu-central-1 \
    --user-pool-id $(aws ssm get-parameter --profile orcha-prod --region eu-central-1 --name /v1-orcha/cognito-user-pool-id --query 'Parameter.Value' --output text) \
    --provider-name Google \
    --query 'IdentityProvider.ProviderDetails.client_id' \
    --output text

Troubleshooting

"Identity provider not found"

Cause: CDK hasn't created the identity providers yet.

Fix: Ensure CDK has been deployed first. The Google identity provider is created with placeholder values during CDK deployment.

"Access denied" when updating IdP

Cause: AWS credentials don't have permission to modify Cognito.

Fix: Ensure your AWS profile has cognito-idp:UpdateIdentityProvider permission. The CDK deployment role should have this.

Google login fails with "redirect_uri_mismatch"

Cause: The redirect URI in Google Cloud Console doesn't match Cognito's callback URL.

Fix: Ensure the Google OAuth app has this exact redirect URI:

https://{cognito-domain}.auth.eu-central-1.amazoncognito.com/oauth2/idpresponse

SSM parameter not found

Cause: The OAuth credentials haven't been stored in SSM yet.

Fix:

  1. Complete GCP setup first
  2. Run ./scripts/update-secrets.sh --from-file secrets
  3. Verify parameters exist: 
    aws ssm get-parameter --profile orcha-prod --region eu-central-1 --name /v1-orcha/cognito-google-client-id

Reference

Resource Prod Value
User Pool Name v1-orcha-user-pool
Cognito Domain v1-orcha-prod-auth
Google IdP Name Google
Google Redirect URI https://v1-orcha-prod-auth.auth.eu-central-1.amazoncognito.com/oauth2/idpresponse
Script scripts/setup-cognito-idps.sh

Authentication Architecture

Google Login:  User → App → Cognito → Google → Cognito → App
Microsoft:     User → App → Microsoft directly → App (bypasses Cognito)

Google uses Cognito's hosted UI flow. Microsoft authentication is handled directly by the application because Cognito's OIDC issuer validation rejects Microsoft's multi-tenant tokens (issuer varies by tenant ID).