You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| GET /api/administration/users/{username} | Get user data from our identity provider along with their roles |[AdminGetUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html)|
89
+
| POST /api/administration/users | Register user in our identity provider, along with roles |[AdminCreateUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html)|
90
+
| PUT /api/administration/users | Update existing user in our identity provider, along with their roles |[AdminUpdateUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html)|
91
+
| DELETE /api/administration/users/{username} | Delete user in our identity provider, along with their roles |[AdminDeleteUser](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.html)|
92
+
| POST /api/administration/users/{username}/reset-password | Reset a user's password |[AdminResetUserPassword](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html)|
93
+
| GET /api/administration/users<br/>?limit={page size}<br/>&cursor={nextCursor from previous response}<br/>&searchString={searchString}<br/>&searchField={USERNAME \| EMAIL \| etc.}<br/>&orgId={role orgId}<br/>&applicationName={role applicationName}<br/>&roleName={roleName} | List/query users from our identity provider, along with their roles.<br/><br/>Uses cursor-based pagination: The response body includes a `nextCursor` field, which can be passed in the `cursor` query parameter to get the next page. When `nextCursor` is `null`, then there are no more users to fetch. |[ListUsers](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html)|
84
94
85
-
Run the `Main` file.
95
+
#### Data structure of user data with roles
86
96
87
-
1. Option 2: Via Maven
88
-
89
-
```bash
90
-
./build-and-run.sh
91
-
```
97
+
```json
98
+
{
99
+
"username": "test.testesen",
100
+
"userId": "4b670e7f-0ae9-4ce8-9a8b-b27d00d2f31d",
101
+
"email": {
102
+
"value": "test@example.org",
103
+
"verified": true
104
+
},
105
+
"phoneNumber": {
106
+
"value": "12345678",
107
+
"verified": false
108
+
},
109
+
"userStatus": "CONFIRMED",
110
+
"enabled": true,
111
+
"createdAt": "2025-12-04T07:25:11Z",
112
+
"attributes": {
113
+
// Attributes are arbitrary key-value data submitted by your BFF.
114
+
// Cognito supports certain standard attributes, such as "name".
115
+
"name": "Test Testesen"
116
+
},
117
+
"roles": [
118
+
{
119
+
"applicationName": "test-application",
120
+
"orgId": "liflig",
121
+
"roleName": "admin",
122
+
"roleValue": null
123
+
}
124
+
]
125
+
}
126
+
```
92
127
93
-
1. Option 3: Package and run with the actual Docker image
128
+
## Deploying User Roles service in your project
129
+
130
+
- Set up a Cognito user pool
131
+
- Deploy User Roles service, using Docker image published on GitHub, along with a Postgres database
132
+
- For the user administration module to be enabled, the service needs the following:
133
+
- Config parameter `aws.cognito.userPoolId`
134
+
- These permissions:
135
+
-`cognito-idp:AdminGetUser`
136
+
-`cognito-idp:AdminCreateUser`
137
+
-`cognito-idp:AdminUpdateUserAttributes`
138
+
-`cognito-idp:AdminDeleteUser`
139
+
-`cognito-idp:AdminResetUserPassword`
140
+
-`cognito-idp:ListUsers`
141
+
- Implement a "pre-token generation lambda" that fetches roles from User Roles to populate Cognito
142
+
JWTs
143
+
- Implement JWT verification and role parsing for authentication and authorization in your APIs
144
+
- For the user administration module:
145
+
- Implement an API client in your BFF that calls the administration API of the User Roles service
146
+
- Your BFF should verify that the requesting user has permission to update roles. This is where
147
+
you enforce your project’s hierarchy of roles (i.e., which roles are allowed to change other
148
+
roles)
149
+
- Implement UI for user management
150
+
151
+
For example implementations of the points above, see the
0 commit comments