Reference

CognitoTokenIssuer

Package Trax.Api.Auth.Jwt.Cognito.Issuer·Namespace Trax.Api.Auth.Jwt.Cognito.Issuer·Source CognitoTokenIssuer.cs, CognitoAccessTokenRequest.cs, CognitoIdTokenRequest.cs, FederatedIdentity.cs, TestJwksServerCognitoExtensions.cs

NO WARRANTY. Trax auth is plumbing, not a security product. You are solely responsible for securing systems that use it. See API Security.

Mints RS256 access and ID tokens with the claims Amazon Cognito user pools emit, for a local Cognito stand-in or for tests. It is the minting counterpart of Trax.Api.Auth.Jwt.Cognito, which validates such tokens; a host that only validates does not reference this package. Refresh tokens are on IRefreshTokenStore.

Signature

public sealed class CognitoTokenIssuer
{
    public CognitoTokenIssuer(string issuer, RsaSecurityKey signingKey, TimeProvider? clock = null);
 
    public string MintAccessToken(CognitoAccessTokenRequest request);
    public string MintIdToken(CognitoIdTokenRequest request);
}
 
public sealed record FederatedIdentity(
    string UserId,
    string ProviderName,
    string ProviderType,
    bool Primary,
    DateTimeOffset DateCreated);
 
public static class TestJwksServerCognitoExtensions
{
    public static CognitoTokenIssuer CreateCognitoIssuer(this TestJwksServer server, TimeProvider? clock = null);
}

Parameters

Members

CognitoAccessTokenRequest

CognitoIdTokenRequest

FederatedIdentity

One entry of the identities claim, serialized with camelCase keys.

Returns

MintAccessToken and MintIdToken return the signed token as a compact JWT string.

Behavior

A token minted here and validated through UseCognito and CognitoJwtPrincipalResolver gives the TraxPrincipal a real Cognito token with the same claims gives. A host that validates the standard aud claim (UseAuthority rather than UseCognito) accepts only the ID token.

Reserved claim names

AdditionalClaims refuses every name the issuer sets itself, and every name CognitoJwtPrincipalResolver reads an identity, a display name or roles from. Minting throws ArgumentException naming the claim:

sub, iss, aud, exp, nbf, iat, jti, auth_time, token_use, client_id, scope, username, cognito:username, cognito:groups, identities, email, email_verified, given_name, family_name, name, preferred_username, role, roles, the ClaimTypes.Role, ClaimTypes.Name and ClaimTypes.NameIdentifier URIs, trax:principal-id and trax:principal-type.

A host that forwards user-editable attributes into AdditionalClaims therefore cannot be made to mint a token with an extra group or another subject. A blank name is skipped.

Examples

using var rsa = RSA.Create(2048);
var key = new RsaSecurityKey(rsa) { KeyId = "local-pool-key-1" };
var issuer = new CognitoTokenIssuer("http://localhost:8080/local_us-east-1_xxx", key);
var userId = Guid.NewGuid();
 
var accessToken = issuer.MintAccessToken(new CognitoAccessTokenRequest
{
    Sub = userId,
    ClientId = "mobile-app-client-id",
    Lifetime = TimeSpan.FromHours(1),
    Username = "alice",
    Scopes = ["openid", "profile"],
    Groups = ["admin"],
});
 
var idToken = issuer.MintIdToken(new CognitoIdTokenRequest
{
    Sub = userId,
    ClientId = "mobile-app-client-id",
    Lifetime = TimeSpan.FromHours(1),
    Email = "alice@example.com",
    EmailVerified = true,
    Identities = [new FederatedIdentity("108222222222", "Google", "Google", Primary: true, DateCreated: DateTimeOffset.UtcNow)],
});

Paired with a test JWKS server:

await using var server = await TestJwksServer.StartAsync();
var issuer = server.CreateCognitoIssuer();
 
var token = issuer.MintAccessToken(new CognitoAccessTokenRequest
{
    Sub = Guid.NewGuid(),
    ClientId = "test-client",
    Lifetime = TimeSpan.FromHours(1),
});

See also

• Test JWT authentication, Cognito tokens in Trax
• IRefreshTokenStore, UseCognito, TestJwksServer