Configure AWS Cognito with Auth0 B2B Connect

Amazon Cognito is an enterprise-grade identity management service from Amazon Web Services (AWS) that provides user authentication, authorization, and federation for web and mobile applications. Configure Amazon Cognito to federate to Auth0 B2B Connect as an OpenID Connect (OIDC) or SAML 2.0 identity provider to add enterprise single sign-on (SSO) to your existing Cognito User Pool.

​

How authentication works

1. The user initiates login in your application.
2. The application sends an authentication request to Amazon Cognito.
3. Amazon Cognito identifies the user as an enterprise user and routes the request to Auth0 B2B Connect.
4. Auth0 B2B Connect sends an authentication request to the user’s enterprise identity provider (for example, Okta or Microsoft Entra ID) using SAML or OpenID Connect (OIDC).
5. The user authenticates with their corporate credentials at the enterprise identity provider.
6. The enterprise identity provider returns a SAML assertion or OIDC token to Auth0 B2B Connect.
7. Auth0 B2B Connect performs domain discovery and returns the federation result to Amazon Cognito.
8. Amazon Cognito issues a token to the application.
9. The application validates the token, bootstraps its session, and grants the user access.

​

Prerequisites

• An Auth0 tenant with B2B Connect - Enterprise enabled
• An Auth0 Organization with domain discovery enabled to an enterprise connection (for example, Okta). To learn more, read Create Organization Domains.
• An AWS account with an active Amazon Cognito User Pool
• A Cognito application client with an active Cognito Domain configured

​

Configure Auth0 B2B Connect

To create a new B2B Connect integration:

1. Navigate to Auth0 Dashboard > Applications > B2B Connect and select +Create Integration to start the B2B Connect wizard.
2. Enter an Integration Name (for example, “AWS Cognito”).
3. Under Integration Type, select Third-party Managed Authorization Server.
4. Select Continue.
5. Under Authentication Protocol, select how your auth server supports federation: OIDC or SAML.
6. Select Continue.

​

Select and configure the authentication protocol

In the wizard, you have the option of OIDC or SAML. Select your authenication protocol and follow the configuration steps.

​

Configure AWS Cognito

​

Add an external identity provider

In the AWS Cognito Console, select your user pool. Navigate to Authentication in the left navigation panel and select Social and external providers. Then select Add identity provider.

​

Configure attribute mapping (recommended)

Attribute mapping links user identity attributes from Auth0 to local user records in your Cognito User Pool. This ensures that email addresses and names are automatically provisioned.

1. Under Attribute mapping, select Edit and map the user attributes required by your application:
   • OIDC: Map username to sub and email to email
   • SAML: Map email to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
2. Select Save changes.

​

Allow users to sign in with the identity provider

1. In the AWS Cognito Console, select your user pool, navigate to Applications in the left navigation, select App clients, and select your application.
2. Select the Login pages tab and select Edit.
3. Under Identity providers, select your identity provider (for example, “Auth0”) from the dropdown.
4. Select Save changes.

​

Verify the identity provider

1. Open your application’s login page and verify that a Continue with Auth0 button appears and successfully redirects you to Auth0.
2. On the Auth0 login screen, enter your email address. Auth0 domain discovery triggers and redirects you to your upstream IdP to complete authentication.

​

OIDC silent redirection (optional)

To skip both the AWS Cognito and Auth0 login pages and route users silently to their enterprise IdP, configure your application to pass login_hint and idp_identifier in the authorization request.

1. Update your application to include an email address input field. On form submission, extract the email and pass both login_hint and idp_identifier in the authorize request to AWS Cognito:
   const params = new URLSearchParams({
     response_type: 'code',
     client_id: 'YOUR_COGNITO_APP_CLIENT_ID',
     redirect_uri: 'YOUR_REDIRECT_URI',
     scope: 'openid profile email',
     identity_provider: 'Auth0',
     login_hint: userEmail,
     idp_identifier: userEmail.split('@')[1],
   });
   
   window.location.href =
     `https://YOUR_AWS_COGNITO_DOMAIN/oauth2/authorize?${params}`;
   
2. With this in place, your application passes login_hint and idp_identifier to AWS Cognito, which silently redirects through AWS Cognito and Auth0, landing directly on the upstream enterprise IdP.