diff --git a/docs/kratos/social-signin/99_amazon.mdx b/docs/kratos/social-signin/99_amazon.mdx new file mode 100644 index 000000000..a7c52a6aa --- /dev/null +++ b/docs/kratos/social-signin/99_amazon.mdx @@ -0,0 +1,146 @@ +--- +id: amazon +title: Add Amazon as a social sign-in provider in Ory +sidebar_label: Amazon +--- + +# Amazon + +:::note + +To add Amazon as a social sign-in provider, you need a Amazon Developer account. Go to +[Amazon Developers](https://www.amazon.com/ap/register?openid.pape.max_auth_age=3600&openid.return_to=https%3A%2F%2Fdeveloper.amazon.com%2Fsettings%2Fconsole%2Fregistration%3Freturn_to%3D%2Fdocs%2Flogin-with-amazon%2Fcustomer-profile.html&prevRID=Y4XBCJ2WDBP9NNGVCGFJ&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=mas_dev_portal&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&language=en_US&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=amzn_developer_portal&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0) +to create one. + +::: + +````mdx-code-block +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + + + + +Follow these steps to add Amazon as a social sign-in provider for your project, using the Ory Console. + +1. Go to . +1. Enable the **Enable OpenID Connect** toggle, then click **Add new OpenID Connect provider**. +1. Click the Amazon logo to open the **Configure Amazon** screen. You may need to click **Show more providers** to see the full list of providers. +1. Copy the Redirect URI and save it for later use. +1. Follow the [official steps](https://developer.amazon.com/docs/login-with-amazon/register-web.html) to create a security profile. +1. Once you've created the security profile, click **Show Client Secret** and copy the Client ID and Client secret. Then paste them into the corresponding fields in the Ory Console's **Configure Amazon** screen. +1. In the Ory Console, click **Save Configuration** to enable Amazon as a social sign-in provider. +1. On Amazon Developers, click **Save Changes**. +1. Open the Amazon **Security Profile Management** screen, select the **Web Settings** tab, click **Edit**, and paste the redirect URI into the **Allowed Return URLs** field. Click **Save**. + +:::note + +These steps cover the basic configuration of a social sign-in provider integration. At this point, the user experience is +incomplete. To complete the configuration and ensure a smooth and secure user experience, configure the [scopes](#scopes) and +[data mapping](#data-mapping) as described in the next section. + +::: + +## Additional configuration + +When adding a social sign-in provider, you can customize the integration by defining the OAuth scopes Ory requests from the +provider and by setting up custom data mappings. + +### Scopes + +In the **Scopes** field, you can define the OAuth (access) scopes that Ory requests from the sign-in provider. Defining access scopes enables you to +interact with the provider's APIs on behalf of the user, or to access additional user data, which is exposed as claims for data +mapping. + +For a basic setup, follow these steps to add the profile access scope: + +- In Ory Console's **Configure Amazon** screen, click **Show advanced settings**. +- In the **Scopes** field, enter `profile` and click **Add**. + +To learn more about the scopes available for Amazon, read the +[related documentation](https://developer.amazon.com/docs/login-with-amazon/customer-profile.html). + +### Data mapping + +In the **Data mapping** field, you can map the data returned by the sign-in provider to traits as defined in the identity +schema. + +To define the mapping, create a Jsonnet code snippet. Read [this document](./data-mapping) to learn more about Jsonnet data +mapping. + +In this sample Jsonnet snippet, the user's `email`, is mapped to `email` in the identity schema. + +```jsonnet +local claims = std.extVar('claims'); +{ + identity: { + traits: { + // The email might be empty if the user hasn't granted permissions for the email scope. + [if 'email' in claims then 'email' else null]: claims.email, + }, + }, +} +``` + + + + +Follow these steps to add Amazon as a social sign-in provider to your project using the Ory CLI: +3. Encode the Jsonnet snippet with [Base64](https://www.base64encode.org/) or host it under an URL accessible to Ory Network. + + ```shell + cat your-data-mapping.jsonnet | base64 + ``` + +4. Download the Ory Identities config from your project and save it to a file: + + ```shell + ## List all available workspaces + ory list workspaces + + ## List all available projects + ory list projects --workspace + + ## Get config + ory get identity-config --project --workspace --format yaml > identity-config.yaml + ``` + +5. Add the social sign-in provider configuration to the downloaded config. Add the Jsonnet snippet with mappings as a Base64 + string or provide an URL to the file. + + ```yaml + selfservice: + methods: + oidc: + config: + providers: + - id: amazon # this is `` in the Authorization callback URL. DO NOT CHANGE IT ONCE SET! + provider: amazon + client_id: .... # Replace this with the OAuth2 Client ID provided by Amazon app + client_secret: .... # Replace this with the OAuth2 Client Secret provided by Amazon app + mapper_url: "base64://{YOUR_BASE64_ENCODED_JSONNET_HERE}" + # Alternatively, use an URL like this example + # mapper_url: https://storage.googleapis.com/example-example-prd/example-file + scope: + - profile + pkce: "force" + enabled: true + ``` + +6. Update the Ory Identities configuration using the file you worked with: + + ```shell + ory update identity-config --project --workspace --file identity-config.yaml + ``` + + + +```` + +## Troubleshooting + +```mdx-code-block +import SocialSigninTroubleshooting from '../_common/social-sign-in-troubleshooting.mdx' + + +``` diff --git a/src/sidebar.ts b/src/sidebar.ts index 090fee643..2ae970f6f 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -58,6 +58,7 @@ const oidcSSO: SidebarItemConfig = { "kratos/social-signin/linkedin", "kratos/social-signin/x-twitter", "kratos/social-signin/line", + "kratos/social-signin/amazon", ], }, "kratos/social-signin/data-mapping",