Cognito hosted auth: pass parameters into pre-token generation trigger

0

I am trying to implement a custom access token solution using Cognito. I have a custom pre-token trigger from where I can add arbitrary claims into the issued tokens. However, I need to be able to decide based on user input, which claims to insert into the token. Specifically, I am trying to implement switch-account functionality by re-authenticating the user and giving them a fresh credential. However, I don't see any mechanism to pass the user selection via the login UI or through the InitiateAuth API in a way that is accessible to the pre-token generation Lambda. Am I missing something obvious?

I cannot use resource servers or custom scopes here, as the number of accounts is potentially as large as the number of users. This needs to be a dynamic claim for this approach to work. E.g. I want to be able to do something like this:

export async function handler(event: PreTokenGenerationV2TriggerEvent) {
  const userAccountSelection = extractFromEvent(event);

  // custom validation logic to ensure this user is permitted to access the selected account ...

  event.response.claimsAndScopeOverrideDetails = {
    accessTokenGeneration: {
      claimsToAddOrOverride: {
        account_id: `account:${userAccountSelection}`,
      },
    },
  };
}
asked 2 months ago77 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions