AWS Cognito as Django authentication back-end for web site

python django amazon-web-services authentication amazon-cognito
Lars Ericson picture Lars Ericson · May 29, 2017 · Viewed 13.1k times · Source

My reading of Cognito is that it can be used in place of a local Django admin database to authenticate users of a website. However I am not finding any soup-to-nuts examples of a basic "Hello, World" app with a login screen that goes through Cognito. I would very much appreciate it if someone could post an article that shows, step-by-step, how to create a Hello World Django app and a Cognito user pool, and then how to replace the default authentication in Django with a call to AWS Cognito.

In particular I need to know how to gather the information from the Cognito admin site that is needed to set up a call to Cognito API to authenticate a user.

There are two cases to consider: App user login to App, and Admin login to django Admin URL of site. I assume that I would want to use Cognito for both cases, otherwise I am leaving a potential hole where the Admin URL is using a weaker login technology.

Current answers on AWS forums and StackExchange either say:

(1) It is a waste of time to use Cognito for authenticating a website, it is only for access to AWS resources

(2) It is not a waste of time. I am about to give up. I have gone as far as creating a sample Cognito user pool and user groups, and of scouring the web for proper examples of this use case. (None found, or I wouldn't be writing.)

(3) https://github.com/capless/warrant, https://github.com/metametricsinc/django-warrant are two possible solution from the aws forums.

Answer

Gal Silberman picture Gal Silberman · Feb 22, 2018

If you are reading this, you probably googled "aws cognito django" xD.

I just want to share what I did in order to get this thing to work:

  • Django-Warrant. Great aws cognito wrapper package.
  • Make sure to understand your current User model structure. If you use custom user model, don't forget to map it using COGNITO_ATTR_MAPPING setting.

  • Change your authentication to support 3rd party connectivity. When you get from the client some Cognito token, convert it into your own token using oAuth/JWT/Session.

  • Rethink your login/register process. Do you want different registration? The django-warrant package supports it...

At the end of the day, this is a GREAT solution for fast authentication.

Related questions

Amazon SES SMTP with Django

I'm trying to use Amazon's new SMTP service for SES with Django 1.3.1 but I'm not having much luck. I've created my SES SMTP credentials and have this in my settings: EMAIL_USE_TLS = True EMAIL_HOST = 'email-smtp.us-east-1.amazonaws.com' …

Read More
Invalid requirements.txt on deploying django app to aws beanstalk

I have been deploying my app without any issues to the beanstalk environment until my latest commit. Now I get this Time Type Details 2013-09-01 10:19:12 UTC+0800 ERROR Failed to deploy application. 2013-09-01 10:19:11 UTC+0800 ERROR Responses from [i-50f40…

Read More
AWS Elastic Beanstalk logging with python (django)

How do you manage your application logs in AWS elastic beanstalk? Which file you write you application logs to? I'm using the following Logging configuration in my development environment but this doesn't work when I deploy in AWS. DEBUG_LOG_…

Read More