Long time ago, in 2010, CakeDC Users plugin for CakePHP was released for CakePHP 1.3. Almost nine years has passed and the initial code has changed dramatically, offering new and exciting features.

In 2011 the team released the first version to be compatible with the new CakePHP 2.0. At this moment we focused in keeping the same features and only adding support for the new version of the framework.

When CakePHP 3.0 arrived in 2015 we decided to refactor Users plugin completely, making it easier to use but also adding terrific features out of the box like:

• Social login with most popular providers
• RBAC permissions
• Superuser
• And much more..

It continued evolving and today we will show how to use the latest provider we have added to the social login feature in the plugin, Amazon Cognito.

Let’s talk first about it. We'll use Amazon Cognito basically as an Oauth 2.0 Server. It'll let you manage your user groups and users. It provides a simple interface to sign up, sign-in and also use many social providers like Facebook, Google and Amazon. It also allows using SAML 2.0 providers and they promise it may scale to millions of users. You can also fully customize form and buttons.

Best of all, it is free for the first 50,000 logins.

Let's start configuring Amazon Cognito in AWS Panel. We must first create a user pool. You could have different user pools and each of them having an exclusive set of features.

Now we need to customize our new pool adding a pool name, etc. We can use default settings for testing purposes. If you want to customize fields you should then go through steps.

Once we check everything is okay we can click on Create Pool.

Now, it's time to setup App Clients. If you are familiar with OAuth and another services it is like creating a Facebook or Twitter App.

And then click on Add an app client.  Just add a name and save.

Remember to write down your client ID and client secret because they will be needed later to configure Users plugin.

The next step is to setup app client settings. We need to configure:

• Callback url: set it to /auth/cognito if you want to use plugin defaults.
• The flow to Authorization code grant and the scopes you must select at least email and openid. You can select profile in case you want to get all the user information from cognito.

Finally we need to configure a domain name for the user pool. Use a custom domain or a subdomain from Cognito.

Now that we are ready with Cognito setup, let’s easily create a new CakePHP app, to connect with Amazon Cognito.

First, we need a new CakePHP app:

composer create-project --prefer-dist cakephp/app users-app

Remember to create a new empty database.

Now we can go to users-app folder and run:

composer require cakedc/users

After CakeDC Users plugin is installed, we need to install Oauth 2 Cognito provider package:

composer require cakedc/oauth2-cognito

CakeDC Users plugin configuration is pretty easy:

$this->addPlugin('CakeDC/Users');

    public function pluginBootstrap()
    {
        parent::pluginBootstrap();
        Configure::load('users');
    }

• Load the Users Plugin

  bin/cake plugin load CakeDC/Users

• If you prefer to do this manually, add this line at the end of your src/Application.php bootstrap() method
• Add the following line into AppController::initialize() method

  $this->loadComponent('CakeDC/Users.UsersAuth');

• Add the following code to your src/Application.php pluginBootstrap() method to ensure we override the plugin defaults
• Add the file config/users.php with your specific configuration, including

return [
    'Users.Social.login' => true,
    'OAuth.providers.cognito.options.clientId' => 'CLIENT_ID',
    'OAuth.providers.cognito.options.clientSecret' => 'CLIENT_SECRET',
    'OAuth.providers.cognito.options.cognitoDomain' => 'DOMAIN',
    'OAuth.providers.cognito.options.region' => 'REGION',
];

In case you used a custom domain for you user pool, you can replace cognitoDomain option by using hostedDomain option (including protocol):

     'OAuth.providers.cognito.options.hostedDomain' => 'YOUR DOMAIN',

Scope option defaults to

email openid

. If you selected another scopes, you may want to add them as well:

     'OAuth.providers.cognito.options.scope' => 'email openid profile',

Finally we just need to go to /login.

and click on Sign in with Cognito. If everything is setup correctly you should see the following screen:

You can previously create a user in AWS panel or just click signup on that screen. After login you will be redirected to homepage in CakePHP App.

As you can see, the setup for both Cognito and App are simple if you use default settings. However after testing defaults, you can start customizing forms, fields, adding third party apps. You have no limits.

Last words

We create and maintain many open source plugins as well as contribute to the CakePHP Community as part of our open source work in CakeDC.

While developing this provider, we've also published a generic Oauth2 Amazon Cognito repository.

Reference

• Oauth2 Amazon Cognito provider
• Amazon Cognito
• CakeDC/Auth RBAC Documentation
• Using RBAC as a CakePHP Middleware
• CakeDC/Users Documentation