EKS集群下API Gateway+Cognito认证集成及相关问题咨询

Hey there! Let's tackle your three questions step by step—since you already have EKS connected to API Gateway via ALB Ingress Controller, you're halfway there to building that decoupled auth setup.

1. Integrating Cognito with Existing LDAP (Is SAML the only way?) #

Nope, you have two solid options here, depending on your LDAP setup:

• Direct LDAP Integration (No SAML required): Cognito User Pools have built-in support for LDAP as a third-party identity provider. You can configure this directly in the Cognito console:
  1. Go to your User Pool → Identity Providers → LDAP
  2. Enter your LDAP server details (host, port, encryption method)
  3. Set up a bind DN (service account with permissions to search LDAP) and user search base/filter
  4. Map LDAP attributes (like cn to Cognito's username, mail to email)
     This lets users log in with their existing LDAP credentials directly through Cognito, without needing a SAML layer.
• SAML Integration: If your LDAP is backed by a SAML identity provider (like Active Directory Federation Services/ADFS), you can set up Cognito as a SAML service provider. This is useful if you already have a SAML infrastructure in place—you'll configure Cognito to trust the SAML assertions from your LDAP-based IdP, and users will authenticate via the SAML flow.

2. Can I use my self-hosted OAuth2 authentication endpoint? #

Absolutely! API Gateway supports Custom Authorizers (Lambda-based) that let you hook into your existing OAuth2 system. Here's how to set it up:

• Create a Lambda function that receives the incoming request's authorization token (e.g., a JWT from your OAuth2 endpoint)
• The Lambda will call your self-hosted OAuth2 endpoint to validate the token's authenticity and check permissions
• Configure your API Gateway methods to use this Lambda as the custom authorizer
• The Lambda returns an IAM policy that either allows or denies the request to proceed to your EKS services

If you want to handle token issuance through your own endpoint too, you can create a dedicated API Gateway resource that integrates directly with your OAuth2 token endpoint—users send their credentials to this API Gateway endpoint, which forwards the request to your OAuth2 service and returns the token.

3. How to implement username/password auth and get JWT via API Gateway + Cognito #

Here's the end-to-end flow and setup steps:

Step 1: Configure Cognito User Pool for password auth #

• In your Cognito User Pool, go to App Integration → App clients
• Create or edit an app client, and enable the ALLOW_USER_PASSWORD_AUTH (for end-users) or ALLOW_ADMIN_USER_PASSWORD_AUTH (for admin-initiated logins) auth type in the "Auth flows configuration" section
• Make sure to note the App Client ID and Client Secret (if you're using a secret)

Step 2: Get JWT via Cognito's Auth API #

Users can submit their username/password to Cognito's InitiateAuth API to retrieve JWT tokens (ID Token, Access Token, Refresh Token). If you want to hide the direct Cognito API call behind your API Gateway, you can:

• Create a new API Gateway resource (e.g., /auth/login)
• Set up an integration request to Cognito's InitiateAuth API (using AWS Service integration type, targeting Cognito's InitiateAuth action)
• Map the incoming request body (username/password) to the required Cognito API parameters

Step 3: Secure API Gateway endpoints with Cognito #

• In API Gateway, create a Cognito Authorizer that points to your User Pool and App Client ID
• Attach this authorizer to all the API methods you want to protect
• When users make requests to your API, they'll include the Cognito Access Token in the Authorization header (format: Bearer <token>)
• API Gateway will automatically validate the token against Cognito—if valid, it forwards the request to your EKS services; if not, it returns a 401/403 error

内容的提问来源于stack exchange，提问作者Yan