User Auth technique

 

Full Federated Login Flow: Cognito + Azure AD

1. User triggers login

Your app redirects the user to this Cognito URL:

https://prod-timemate.auth.us-east-1.amazoncognito.com/authorize?client_id=jssams30e4gciifv89j6abc5f&response_type=token&scope=email+openid&redirect_uri=https://app.timemate.aeturnum.com%2Ftimesheet

2. Cognito redirects the user to Microsoft login (Cognito redirects to Azure AD)

3. Azure AD authenticates the user

•  Azure checks its own user pool for the username and password.
•  If the user exists and credentials are valid → login success.
•  Azure returns an ID token (and maybe access token) to Cognito.

4. Cognito extracts user info

•  Cognito reads claims from Azure’s token (like email, `sub`, name, etc.).
•  If this is the user's first login, Cognito creates a federated user in its user pool (linked to Azure AD).

5. Cognito issues its own token

•  Cognito now generates and returns a Cognito JWT token (ID token + access token) to your app.
•  This is what TimeMate app uses to authenticate the user for its backend and APIs.

Summary:

“We call AWS Cognito → Cognito calls Azure → Azure checks its user pool and credentials → Azure returns token → Cognito extracts user info from the token → Cognito creates the user in its own user pool → Cognito issues its own token.”

Token Source: Azure AD token

Purpose: Proves the user is real/authenticated by Microsoft 

Token Source: Cognito token

Purpose: Used by your app to authorize access to resources (APIs, user info, etc.)

Cognito does not pass along Azure’s token to your app — it issues its own.