jacob-mathison/query-orchestration
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

Merged in feature/cognito-mfa-1 (pull request #154)

Browse Source 
DRAFT for mfa demo

* for mfa demo

* Merge branch 'main' of bitbucket.org:aarete/query-orchestration into feature/cognito-mfa-1

* Merge branch 'main' of bitbucket.org:aarete/query-orchestration into feature/cognito-mfa-1

* cleanup

* list cognito users

* Merge branch 'main' of bitbucket.org:aarete/query-orchestration into feature/cognito-mfa-1
This commit is contained in:
Jay Brown
2025-06-10 17:01:30 +00:00
parent 693457ce2d
commit e544f08505
12 changed files with 280 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/queryAPI/homehandler.go
+2 -9
View File
@@ -26,22 +26,15 @@ var endpointsList = []string{
// Client Service Endpoints
"/client",
"/client/:id",
"/client/:id/status",
"/client/:id/collector",
"/client/:id/documents",
"/client/:id/export",
// Query API Endpoints
"/query",
"/query/:id",
"/query/:id/test",
// Document Service Endpoints
"/document/:id",
"/document",
// Export Service Endpoints
"/export/:id",
"/export",
}
// homeHandler renders a simple HTML page with links to all endpoints
cmd/cognito_test/mfa/creation.script.examples/create.all.md
+35
View File
@@ -0,0 +1,35 @@
# User pool creation
## Step-by-Step Process for creation of new user pool and dependencies
1. **Create User Pool**: Creates a new Cognito User Pool with email as the username attribute and password policies.
2. **Enable MFA**: Configures the user pool to require MFA using software token (TOTP) authentication.
3. **Create Domain**: Sets up a custom Cognito domain for the hosted UI at `https://{DOMAIN_PREFIX}.auth.{AWS_REGION}.amazoncognito.com`.
4. **Apply UI Customization**: Adds minimal branding with custom CSS for the login pages.
5. **Create App Client**: Creates an application client with:
- OAuth code flow
- Refresh token validity
- Callback and logout URLs
- Client secret
6. **Create Test User**: Creates a test user with the specified email and phone number.
## Output
The script logs all operations to `creation.log.txt` and outputs a summary with:
- User Pool ID
- Domain URL
- App Client ID
- App Client Secret
- Test user information
## Usage
Edit the
`DOMAIN_PREFIX`, `LOG_FILE` and
`NEW_USER_POOL_NAME` with unique values for your test run.
cmd/cognito_test/mfa/creation.script.examples/create.all.sh
Executable
+99
View File
@@ -0,0 +1,99 @@
#!/usr/bin/env bash
# this is the second version of this script with a few bug fixes around the
# domain creation and the ui customization. This version works and is tested.
AWS_REGION="us-east-2"
AWS_PROFILE="aarete"
# domain prefix should be unique
DOMAIN_PREFIX="aarete-mfa-test2"
LOG_FILE="creation.log.txt"
# pool stuff
# this is the unique name of the new pool to create. (and all of its dependencies)
NEW_USER_POOL_NAME="Aarete-MFA-Test-Pool-2"
# user stuff
TEST_USER_EMAIL="foo@gmail.com"
TEST_USER_PHONE="+18889091485"
TEMP_PASSWORD="TempPass123!"
> "$LOG_FILE"
echo "Creating Cognito User Pool..." | tee -a "$LOG_FILE"
USER_POOL_ID=$(aws cognito-idp create-user-pool \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--pool-name "$NEW_USER_POOL_NAME" \
--username-attributes "email" \
--auto-verified-attributes "email" \
--policies "PasswordPolicy={MinimumLength=8,RequireUppercase=true,RequireLowercase=true,RequireNumbers=true,RequireSymbols=true}" \
--query "UserPool.Id" --output text)
if [ $? -ne 0 ] || [ -z "$USER_POOL_ID" ]; then
echo "Error: Failed to create Cognito User Pool." >&2
exit 1
fi
echo "User Pool created with ID $USER_POOL_ID" | tee -a "$LOG_FILE"
echo "Enabling TOTP MFA (software token) for the user pool..." | tee -a "$LOG_FILE"
aws cognito-idp set-user-pool-mfa-config \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--mfa-configuration "ON" \
--software-token-mfa-configuration Enabled=true
echo "Creating user pool domain '$DOMAIN_PREFIX'..." | tee -a "$LOG_FILE"
aws cognito-idp create-user-pool-domain \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--domain "$DOMAIN_PREFIX" \
--user-pool-id "$USER_POOL_ID"
echo "Waiting for domain to activate (60 seconds)..." | tee -a "$LOG_FILE"
sleep 60
echo "Applying required minimal branding at pool level..." | tee -a "$LOG_FILE"
aws cognito-idp set-ui-customization \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--css ".banner-customizable {background-color:#000000;} .label-customizable {color:#FFFFFF;}"
echo "Creating app client for user pool..." | tee -a "$LOG_FILE"
APP_CLIENT_OUTPUT=$(aws cognito-idp create-user-pool-client \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--client-name "AareteMfaTestClient" \
--generate-secret \
--refresh-token-validity 30 \
--allowed-o-auth-flows "code" \
--allowed-o-auth-scopes "openid" "email" "profile" \
--allowed-o-auth-flows-user-pool-client \
--callback-urls "http://localhost:8080/login-callback" \
--logout-urls "http://localhost:8080/logout" \
--supported-identity-providers "COGNITO")
CLIENT_ID=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientId')
CLIENT_SECRET=$(echo "$APP_CLIENT_OUTPUT" | jq -r '.UserPoolClient.ClientSecret')
echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"
echo "Creating test user '$TEST_USER_EMAIL'..." | tee -a "$LOG_FILE"
aws cognito-idp admin-create-user \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--username "$TEST_USER_EMAIL" \
--user-attributes Name=email,Value="$TEST_USER_EMAIL" Name=phone_number,Value="$TEST_USER_PHONE" \
--temporary-password "$TEMP_PASSWORD" \
--message-action "SUPPRESS"
aws cognito-idp admin-set-user-password \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--username "$TEST_USER_EMAIL" \
--password "$TEMP_PASSWORD" \
--permanent
echo "==== Creation Summary ====" | tee -a "$LOG_FILE"
echo "User Pool ID: $USER_POOL_ID" | tee -a "$LOG_FILE"
echo "Domain URL: https://$DOMAIN_PREFIX.auth.$AWS_REGION.amazoncognito.com" | tee -a "$LOG_FILE"
echo "App Client ID: $CLIENT_ID" | tee -a "$LOG_FILE"
echo "App Client Secret: $CLIENT_SECRET" | tee -a "$LOG_FILE"
echo "Test User: $TEST_USER_EMAIL" | tee -a "$LOG_FILE"
cmd/cognito_test/mfa/creation.script.examples/create.user.sh
Executable
+28
View File
@@ -0,0 +1,28 @@
AWS_REGION="us-east-2"
AWS_PROFILE="aarete"
LOG_FILE="user.creation.log.txt"
# pool stuff
# this is the unique name of the new pool to create. (and all of its dependencies)
USER_POOL_ID="us-east-2_21upuTkkT"
# user stuff - user email must be unique for this user pool
TEST_USER_EMAIL="foo2@gmail.com"
TEST_USER_PHONE="+18889091485"
TEMP_PASSWORD="TempPass123!"
echo "Creating test user '$TEST_USER_EMAIL'..." | tee -a "$LOG_FILE"
aws cognito-idp admin-create-user \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--username "$TEST_USER_EMAIL" \
--user-attributes Name=email,Value="$TEST_USER_EMAIL" Name=phone_number,Value="$TEST_USER_PHONE" \
--temporary-password "$TEMP_PASSWORD" \
--message-action "SUPPRESS"
aws cognito-idp admin-set-user-password \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--username "$TEST_USER_EMAIL" \
--password "$TEMP_PASSWORD" \
--permanent
cmd/cognito_test/mfa/creation.script.examples/delete.all.md
+29
View File
@@ -0,0 +1,29 @@
# AWS Cognito User Pool Deletion Script
## Overview
This script (`delete.all.sh`) automates the process of deleting an AWS Cognito User Pool and its associated domain. It's designed to clean up Cognito resources that were created for testing purposes.
## What the Script Does
1. Identifies a Cognito User Pool by its domain prefix (`aarete-mfa-test`)
2. Deletes the domain associated with the User Pool
3. Waits for the domain deletion to complete (30-second wait)
4. Deletes the User Pool itself
5. Confirms successful cleanup
## Prerequisites
- AWS CLI installed and configured
- Appropriate AWS permissions to delete Cognito resources
- AWS profile named "aarete" configured
## Configuration
The script uses the following configuration:
- AWS Region: us-east-2
- AWS Profile: aarete
- Domain Prefix: aarete-mfa-test
## Usage
cmd/cognito_test/mfa/creation.script.examples/delete.all.sh
Executable
+39
View File
@@ -0,0 +1,39 @@
#!/usr/bin/env bash
# this script is untested
AWS_REGION="us-east-2"
AWS_PROFILE="aarete"
# set the domain prefix to delete here
DOMAIN_PREFIX="aarete-mfa-test"
USER_POOL_ID=$(aws cognito-idp describe-user-pool-domain \
--region "$AWS_REGION" \
--profile "$AWS_PROFILE" \
--domain "$DOMAIN_PREFIX" \
--query 'DomainDescription.UserPoolId' \
--output text)
if [ -z "$USER_POOL_ID" ]; then
echo "User pool not found for domain $DOMAIN_PREFIX. Exiting."
exit 1
fi
echo "User pool id to delete is $USER_POOL_ID."
echo "Deleting domain $DOMAIN_PREFIX from user pool $USER_POOL_ID..."
aws cognito-idp delete-user-pool-domain \
--region "$AWS_REGION" \
--profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" \
--domain "$DOMAIN_PREFIX"
echo "Waiting 30 seconds for domain deletion..."
sleep 30
echo "Deleting user pool $USER_POOL_ID..."
aws cognito-idp delete-user-pool \
--region "$AWS_REGION" \
--profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID"
echo "Deletion complete. All resources cleaned up."
cmd/cognito_test/mfa/creation.script.examples/describe.user.pool.client.sh
Executable
+6
View File
@@ -0,0 +1,6 @@
aws cognito-idp describe-user-pool-client \
--user-pool-id us-east-2_1y6po8rR8 \
--client-id 552cqkf3640t39ncehkmgpce31 \
--region us-east-2 \
--profile aarete
cmd/cognito_test/mfa/creation.script.examples/describe.user.pool.domain.sh
+5
View File
@@ -0,0 +1,5 @@
aws cognito-idp describe-user-pool-domain \
--domain aarete-mfa-test2 \
--region us-east-2 \
--profile aarete
cmd/cognito_test/mfa/creation.script.examples/describe.user.pool.sh
Executable
+2
View File
@@ -0,0 +1,2 @@
aws cognito-idp describe-user-pool --user-pool-id us-east-2_1y6po8rR8 --region us-east-2 --profile aarete > user.pool1.json
cmd/cognito_test/mfa/creation.script.examples/list-cognito-users.sh
Executable
+22
View File
@@ -0,0 +1,22 @@
#!/bin/bash
# For testing and demos. Lists all of the users in a given user pool and then formats
# them in one line per user format for use in permit.io import.
# AWS Configuration
AWS_REGION="us-east-2"
AWS_PROFILE="aarete"
LOG_FILE="user.list.log.txt"
# User Pool Configuration
USER_POOL_ID="us-east-2_21upuTkkT"
echo "Listing all users in user pool '$USER_POOL_ID'..." | tee -a "$LOG_FILE"
# List all users in the user pool (output is JSON by default)
aws cognito-idp list-users \
--region "$AWS_REGION" --profile "$AWS_PROFILE" \
--user-pool-id "$USER_POOL_ID" > userlist.json
# convert the json output to one line per user.
echo "username, email, phone, subject id"
cat userlist.json | jq -r '.Users[] | [.Username, (.Attributes[] | select(.Name == "email") | .Value), (.Attributes[] | select(.Name == "phone_number") | .Value), (.Attributes[] | select(.Name == "sub") | .Value)] | @csv'
cmd/cognito_test/mfa/creation.script.examples/list.pool.clients.sh
Executable
+5
View File
@@ -0,0 +1,5 @@
aws cognito-idp list-user-pool-clients \
--user-pool-id us-east-2_1y6po8rR8 \
--region us-east-2 \
--profile aarete
cmd/cognito_test/mfa/creation.script.examples/readme.md
+8
View File
@@ -0,0 +1,8 @@
# MFA related scripts
This directory has various setup and helper scripts that were needed
to setup the first cognito MFA demo. All of these script work and will inform
the actual development that will follow.
See these for more information.
- [create.all.md](./create.all.md)
- [delete.all.md](./delete.all.md)