如何从User Pool（非Identity Pool）使用联邦身份验证？登录方式问询

Great question—let’s break down your options clearly when working with federated authentication in an Amazon Cognito User Pool (not Federated Identity Pools):

1. Are there SignIn APIs for federated users, or is the hosted UI the only option? #

You don’t have to rely solely on the hosted UI—there are ways to use Cognito’s APIs alongside third-party identity provider (IdP) SDKs to handle federated sign-ins. Here’s how it works:

• First, use the native SDK of your chosen IdP (e.g., Google Sign-In for Android, Facebook Login SDK) to authenticate the user directly within your app. This gives you a valid ID Token from the third-party provider.
• Then, call Cognito’s InitiateAuth API (or AdminInitiateAuth if you’re working server-side) with the following parameters:
  • AuthFlow: Set to AUTHENTICATE_WITH_FEDERATED_IDENTITY
  • AuthParameters: Include IDENTITY_PROVIDER (the name of your configured IdP in Cognito, like Google), TOKEN (the third-party ID Token you obtained), and your Cognito User Pool client ID.
• Cognito will validate the third-party token, and if successful, return Cognito-specific tokens (access token, ID token, refresh token) that you can use for your app’s authorization.

If you’re using AWS Amplify (the official SDK for mobile/web), it wraps this flow into simpler methods, so you don’t have to handle the raw API calls yourself.

2. Do I have to open a browser to the hosted UI URL? #

Nope! The hosted UI is a quick, low-code option, but it’s not mandatory. The approach I outlined above lets you keep users inside your app entirely—no external browser redirects required.

3. Can users stay in the app to sign in, like Google’s native popup flow on Android? #

Absolutely! This is the ideal approach for a seamless user experience. For example, on Android:

• Integrate the Google Sign-In SDK, then launch its native sign-in intent. This triggers a system-level popup (not a browser) where users can select their Google account or enter credentials.
• Once authenticated, extract the Google ID Token from the GoogleSignInAccount object.
• Pass this token to Cognito via InitiateAuth (or Amplify’s wrapped method) to get your Cognito tokens.

The entire process happens within your app’s context—users never leave to visit an external browser.

Key Notes: #

• Make sure your Cognito User Pool is properly configured with your chosen IdP (e.g., add Google as an identity provider, input the correct client ID and secret from Google Cloud Console).
• On the third-party IdP side, configure your app’s package name, signature, and allowed redirect URIs (if needed) to ensure the SDK can authenticate your app.

内容的提问来源于stack exchange，提问作者mipnw