Amazon Cognito introduces Lambda trigger for federated sign-in customization

Overview of the new feature

Amazon Cognito now supports an inbound federation Lambda trigger, which provides developers with greater control over user authentication flows. This trigger allows developers to intercept the authentication response from external identity providers (IdPs) immediately after it's received by Cognito.

Functionality of the inbound federation Lambda trigger

This Lambda trigger enables developers to customize the user attributes that are created in the Cognito user pool. When a user signs in through an IdP, the trigger is activated, allowing the received attribute data to be transformed, filtered, or enriched before creating the user profile.

Advantages for developers and enterprises

For B2B SaaS providers, this new functionality helps retain organizational control over identities, alleviating the burden of managing credentials. Furthermore, it addresses common issues such as handling excessive group memberships from SAML providers and avoiding duplicate records when users attempt to sign in through different social providers.

Getting started with the trigger

Developers can implement the inbound federation Lambda trigger using the provided parameters from Amazon Cognito’s documentation. This includes access to common parameters as well as specific details about the external IdP used by the signing-in user, enabling tailored responses based on the context.