How do I link or unlink external federated users to native Cognito users?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Link an external federated user

You can link up to five federated users to each native user profile.

To link your federated users, run the following admin-link-provider-for-user AWS CLI command:

aws cognito-idp admin-link-provider-for-user \
    --user-pool-id User_Pool_ID \
    --destination-user ProviderAttributeValue=Username,ProviderName=Cognito \
    --source-user ProviderName=Provider_Name,ProviderAttributeName=Attribute,ProviderAttributeValue=Attribute_Value

Note: Replace User_Pool_ID with your Amazon Cognito user pool ID, Username with the native Amazon Cognito username, and Provider_Name with the third-party IdP. Replace Attribute with the user attribute that's mapped to the IdP and Attribute_Value with the attribute for the federated user.

If the command is successful, then the output show an HTTP 200 status with an empty body.

Note: You can't use Amazon Cognito threat detection with federated sign-in providers. Amazon Cognito user activity logs don't record federated sign-in activity. For more information, see Linking federated users to an existing user profile.

Unlink an external federated user

To unlink the federated user, run the following admin-disable-provider-for-user command:

aws cognito-idp admin-disable-provider-for-user \
    --user-pool-id User_Pool_ID \
    --user ProviderName=Provider_Name,ProviderAttributeName=Attribute,ProviderAttributeValue=Attribute_Value

Note: Replace User_Pool_ID with your Amazon Cognito user pool ID and Provider_Name with your IdP. Replace Attribute with the user attribute that's mapped to the federated IdP and Attribute_Value with the attribute for the federated user.

If the command is successful, then the output show an HTTP 200 status with an empty body.

To confirm that the user's attribute no longer shows the unlinked user, run the admin-get-user command. 

After you unlink the federated user, the user can't use the IdP to sign in to the Amazon Cognito user account.

Related information

User pool sign-in with third party identity providers

Managed login and federation error responses