Amazon Cognito

Feature availability

Feature	Support
OAuth2/OIDC clients	✅ Full
SAML clients	❌ Not supported
Resource servers	✅ Native
Client cloning	✅ Full
Secret rotation	✅ Full
Client suspension	❌ Not supported

Setup

Grant Taco access to the user pool

Taco calls the Cognito user pools API with the AWS SDK, which reads credentials from its default provider chain: AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, AWS_PROFILE, an EKS service account (IRSA), an ECS task role or an EC2 instance profile. Prefer a role over long-lived keys when Taco runs on AWS.

The identity needs these actions on the user pool:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cognito-idp:ListUserPoolClients",
        "cognito-idp:DescribeUserPoolClient",
        "cognito-idp:CreateUserPoolClient",
        "cognito-idp:UpdateUserPoolClient",
        "cognito-idp:DeleteUserPoolClient",
        "cognito-idp:ListUserPoolClientSecrets",
        "cognito-idp:AddUserPoolClientSecret",
        "cognito-idp:DeleteUserPoolClientSecret",
        "cognito-idp:ListResourceServers",
        "cognito-idp:DescribeResourceServer",
        "cognito-idp:CreateResourceServer",
        "cognito-idp:UpdateResourceServer",
        "cognito-idp:DeleteResourceServer"
      ],
      "Resource": "arn:aws:cognito-idp:<region>:<account-id>:userpool/<user-pool-id>"
    }
  ]
}

Set environment variables

PROVIDER=cognito
COGNITO_USER_POOL_ID=eu-west-1_AbCdEfGhI
# Optional: defaults to the region in the user pool ID, then AWS_REGION
COGNITO_REGION=eu-west-1

Client management notes

Clients are user pool app clients. Cognito supports the authorization_code, implicit and client_credentials grants; refresh_token maps to the ALLOW_REFRESH_TOKEN_AUTH auth flow. Other grant types are ignored.
Cognito decides at creation whether a client has a secret: a client created with the none token endpoint auth method stays public, and a confidential one stays confidential. To switch, create a new client.
client_credentials requires a secret, can’t be combined with authorization_code or implicit in the same client, and only accepts resource server scopes.
Scopes are the app client’s allowed OAuth scopes. When a client uses a user flow without any scope, Taco grants openid. A client’s audience is derived from its resource server scopes and isn’t stored separately.
Updating a client keeps every setting Taco doesn’t manage (token validity, attribute permissions, identity providers, SDK auth flows…).
Cognito can’t act as a SAML identity provider, so SAML clients aren’t available.
Cognito has no way to disable an app client: suspending a client in the registration workflow is recorded in Taco only.
Rotating a secret adds a new one with AddUserPoolClientSecret, then deletes the previous ones so only the new secret remains.

Resource servers

Resource servers are managed natively in the user pool. Their identifier can’t be changed after creation. Cognito names scopes <identifier>/<scope>: that’s how they appear in Taco and how to request them. When you add a scope you can give either the bare name or the full name.

To protect the Taco dashboard with Cognito, create a separate confidential app client with the authorization code grant and the openid, email and profile scopes:

AUTH_CLIENT_OPENID_CONFIGURATION_URL=https://cognito-idp.<region>.amazonaws.com/<user-pool-id>
AUTH_CLIENT_ID=your-app-client-id
AUTH_CLIENT_SECRET=your-app-client-secret

Add <BASE_URL>/api/auth/callback/oidc to the app client’s Allowed callback URLs.