Secure your applications with identity sources and tokens - Amazon Verified Permissions
Choosing the right identity provider

Secure your applications with identity sources and tokens

Secure you applications quickly by creating an identity source to represent an external identity provider (IdP) in Amazon Verified Permissions. Identity sources provide information from a user who authenticated with an IdP that has a trust relationship with your policy store. When your application makes an authorization request with a token from an identity source, your policy store can make authorization decisions from user properties and access permissions. You can add an Amazon Cognito user pool or a custom OpenID Connect (OIDC) IdP as your identity source.

You can use OpenID Connect (OIDC) identity providers (IdPs) with Verified Permissions. Your application can generate authorization requests with JSON web tokens (JWTs) generated by an OIDC-compliant identity provider. The user identity in the token is mapped to the principal ID. With ID tokens, Verified Permissions maps attribute claims to principal attributes. With Access tokens, these claims are mapped to context. With both token types, you can map a claim like groups to a principal group, and build policies that evaluate role-based access control (RBAC).

Note

Verified Permissions makes authorization decisions based on information from an IdP token but doesn't interact directly with the IdP in any way.

For a step-by-step walkthrough that builds authorization logic for Amazon API Gateway REST APIs using an Amazon Cognito user pool or OIDC identity provider, see Authorize API Gateway APIs using Amazon Verified Permissions with Amazon Cognito or bring your own identity provider on the AWS Security Blog.

Topics

Choosing the right identity provider

While Verified Permissions works with a variety of IdPs, consider the following when deciding which one to use in your application:

Use Amazon Cognito when:

  • You're building new applications without existing identity infrastructure

  • You want AWS-managed user pools with built-in security features

  • You need social identity provider integration

  • You want simplified token management

Use OIDC providers when:

  • You have existing identity infrastructure (Auth0, Okta, Azure AD)

  • You need to maintain centralized user management

  • You have compliance requirements for specific IdPs