Skip to main content

Configure AWS Cognito

This guide connects DIAL to an AWS Cognito user pool so users authenticate with Cognito and DIAL authorizes them by Cognito group. For the shared workflow and a comparison with other providers, see the SSO / IdP setup overview.

Prerequisites​

  • A running DIAL deployment (DIAL Chat and DIAL Core) and the URL of your DIAL Chat instance, referred to below as <chat_url>.
  • An AWS account with permission to create Cognito user pools.

Step 1: Configure AWS Cognito​

  1. Create a user pool. Follow the AWS guide with:
    • Application type: Traditional web application
    • Sign-in identifier: Username
    • Required sign-up attribute: email
    • Return URL: <chat_url>/api/auth/callback/cognito
  2. Configure the app client. Under Applications → App clients, enable authentication flows ALLOW_USER_SRP_AUTH and ALLOW_REFRESH_TOKEN_AUTH. Under Login pages, set the allowed sign-out URL to <chat_url> and OpenID Connect scopes to OpenID, Email, and Profile.
  3. Create users under User management → Users.
  4. Gather facts for the next steps:
    • User pool ID and Token signing key URL (the JWKS URI), from the pool overview.
    • Client ID and Client secret, from the app client.
    • The AWS region of the pool.
  5. (Optional, RBAC) Create groups under User management → Groups and assign users. You will map these group names to DIAL resources in Step 4.

Step 2: Configure DIAL Chat​

Set these environment variables on DIAL Chat. See DIAL Chat configuration — Cognito for the full list.

AUTH_COGNITO_HOST: "https://cognito-idp.<cognito_region>.amazonaws.com/<cognito_user_pool_id>"
AUTH_COGNITO_CLIENT_ID: "<cognito_client_id>"
AUTH_COGNITO_SECRET: "<cognito_client_secret>"

Step 3: Configure DIAL Core​

Add the provider to the identityProviders section of DIAL Core static settings (settings.json). Generate a random loggingSalt, for example with pwgen -s 32 1.

{
  "identityProviders": {
    "cognito": {
      "jwksUrl": "<cognito_jwks_uri>",
      "issuerPattern": "^https:\\/\\/cognito-idp\\.<cognito_region>\\.amazonaws\\.com\\/<cognito_user_pool_id>$",
      "loggingKey": "sub",
      "loggingSalt": "<random_salt>",
      "rolePath": "cognito:groups"
    }
  }
}

rolePath is cognito:groups, so DIAL reads the user's Cognito groups as roles. For every setting, see the Identity providers reference.

note

DIAL Core reads static settings at startup. Restart Core after editing settings.json. Each setting can also be supplied as an aidial.identityProviders.cognito.* environment variable.

Step 4: Assign roles to resources​

In config.json (dynamic settings), add a Cognito group name to a deployment's userRoles array. Users in that group can then use the deployment.

{
  "models": {
    "chat-gpt-35-turbo": {
      "userRoles": ["cognito-group-name"]
    }
  }
}

Result​

Users log in through Cognito, and DIAL Core authorizes their requests based on Cognito group membership. Group-to-resource mapping is driven entirely by userRoles.

Further reading​