How do I access the group for a Cognito User account?

Question

In AWS Cognito, you can add a user to a group (after first creating a group). A user may belong to one or more groups.

With using the JavaScript SDK (https://github.com/aws/amazon-cognito-identity-js), is there a way to read the assigned Groups? Would aws-sdk provide access over amazon-cognito-identity-js?

score 72 · Accepted Answer · answered May 04 '17 at 17:29

72

If you just need the Cognito UserPools Groups the Authenticated User is a member of, instead of making a separate API call, that data is encoded in the idToken.jwtToken that you received when authenticating.

This is useful for client-side rendering/access decisions in angular/react/etc. apps.

See the "cognito:groups" array claim in this example decoded idToken.jwtToken:

{
  "sub": "a18626f5-a011-454a-b4c2-6969b3155c24",
  "cognito:groups": [
    "uw-app-administrator",
    "uw-app-user"
  ],
  "email_verified": true,
  "iss": "https://cognito-idp.<region>.amazonaws.com/<user-pool-id>",
  "cognito:username": "<my-user-name>",
  "given_name": "<my-first-name>",
  "aud": "<audience-code>",
  "token_use": "id",
  "auth_time": 1493918449,
  "nickname": "Bubbles",
  "exp": 1493922049,
  "iat": 1493918449,
  "email": "<my-email>"
}

Hope this helps.

answered May 04 '17 at 17:29

bfieber

836
7
2

I actually found this out to be the case but never go around to updating the answer. Thanks! – user1322092 May 07 '17 at 15:00
1

I'm not able to view user group when I decoded JWT tokens, can you tell me how did you got tokens decoded. @bfieber – VINEET SHARMA May 10 '17 at 13:13
I also don't get the cognito:groups – Marcus Christiansen Oct 18 '18 at 14:14
I initially had no "cognito:groups" field as well, but when I created a group and then added my user to it, the "cognito:groups" field then showed up in the token. – AshleyS Feb 14 '19 at 10:34

jspeaks · Answer 2 · 2021-08-25T16:07:13.337

I originally expected the Cognito JavaScript API to provide a simple property or method to return the list of groups, but instead I concluded that it was buried within a token, and thus had to learn about jwt. Once the Cognito User is established and the session is retrieved, the array of groups is available within the IdToken.

var jwtDecode = require('jwt-decode');
var AmazonCognitoIdentity = require('amazon-cognito-identity-js');
var CognitoUserPool = AmazonCognitoIdentity.CognitoUserPool;
var CognitoUser = AmazonCognitoIdentity.CognitoUser;

var userPool = new CognitoUserPool({UserPoolId:'', ClientId:''");
...
app.get('/app', function(req, res){
    var cognitoUser = userPool.getCurrentUser();
    if(cognitoUser != null){
        cognitoUser.getSession(function(err, session) {
            if (err) {
                console.error(err);
                return;
            }
            console.log('session validity: ' + session.isValid());

            var sessionIdInfo = jwtDecode(session.getIdToken().jwtToken);
            console.log(sessionIdInfo['cognito:groups']);
        });
    }
});

Exceptionally great example! – user1322092 Aug 23 '17 at 22:33 — user1322092, Aug 23 '17 at 22:33

score 15 · Answer 3 · answered Nov 22 '18 at 22:09

If you're using Amplify, if you use the currentAuthenticatedUser method you can get the groups from the response using:

response.signInUserSession.idToken.payload['cognito:groups']

Or using the currentSession method you can use either of:

response.accessToken.payload['cognito:groups']

or

response.idToken.payload['cognito:groups']

score 10 · Answer 4 · answered Jan 24 '17 at 19:25

10

This API does exist - AdminListGroupsForUser. The reason you're not seeing it is, as the name implies, that the API is currently only available on an admin basis. Cognito doesn't include admin APIs in the mobile SDKs. It would be included in the AWS SDKs/server side SDKs, but it's worth noting that this API does require developer credentials, as do all admin APIs.

answered Jan 24 '17 at 19:25

Jeff Bailey

5,655
1
22
30

Jeff, thanks. I'm writing a public, client-side JS app. I assume I won't be able to use the AWS admin SDK, because of mechanism to store credentials... ? – user1322092 Jan 27 '17 at 03:20
2

That's fair. As an admin API you have to have developer creds, so as a client side app, that's a risky idea. I can take this as a feature request to add a user level version, though! – Jeff Bailey Jan 27 '17 at 04:04
1

Thanks Jeff, appreciate it. Many uses cases. With the ability to read group ID, I can easily use it for tenancy (say for a SaaS app). – user1322092 Jan 27 '17 at 05:04
1

I'll forward that on to the higher ups, thanks for the suggestion! – Jeff Bailey Jan 27 '17 at 05:07

score 3 · Answer 5 · answered Feb 23 '18 at 22:58

3

You do not need to decode anything, the data is already available from session.getIdToken().payload['cognito:groups']

answered Feb 23 '18 at 22:58

LiriB

814
8
12

2

Cannot get this to work, says session.getIdToken().payload is undefined even though session.getIdToken() is defined as { jwtToken:"ejkwjkwjflkwfj..." } – Graham Hesketh Jul 05 '18 at 14:27

score 2 · Answer 6 · answered Nov 28 '17 at 07:38

2

You can now easily get the user groups from the user session:

session.getIdToken().decodePayload();

This contains an array of groups in the cognito:groups key returned

answered Nov 28 '17 at 07:38

bwobbones

2,398
3
23
32

Cannot get this to work, it says "session.getIdToken(...).decodePayload is not a function" – Graham Hesketh Jul 05 '18 at 14:24
Probably you should move away from this library now and look at aws-amplify – bwobbones Jul 05 '18 at 14:32
Move away from what library? – Graham Hesketh Jul 05 '18 at 14:53
amazon-cognito-identity-js – bwobbones Jul 05 '18 at 15:03

score 0 · Answer 7 · answered Feb 24 '20 at 21:42

If you mean to list groups for a specific user in the backend and return them as an API, here's a complete example using golang's aws sdk:

func sessionWithRegion(region *string) *session.Session {
    sess := Session.Copy()
    if v := aws.StringValue(sess.Config.Region); len(v) == 0 {
        sess.Config.Region = region
    }

    return sess
}

func getGroupsForUser(region, userPoolId, userName *string, limit int64, nextToken ...*string) (*cognitoidentityprovider.AdminListGroupsForUserOutput, error) {
    sess := sessionWithRegion(region)
    svc := cognitoidentityprovider.New(sess)

    input := &cognitoidentityprovider.AdminListGroupsForUserInput{
        UserPoolId: userPoolId,
        Username:   userName,
        Limit:      &limit,
    }

    if nextToken != nil && len(nextToken) > 0 {
        input.NextToken = nextToken[0]
    }

    return svc.AdminListGroupsForUser(input)

}

nextToken is used to support pagination to load more groups in case we still have users to return from cognito to return/fetch, in other words, is to fetch next page. here is a simple example of how your calls should look like

func listGroups(pageNo *string) ([]*cognitoidentityprovider.GroupType, *string, error) {

    page, err := getGroupsForUser(aws.String("us-east-1"), aws.String("xxx"), aws.String("myuserName"), 60, map[bool]*string{true: pageNo, false: nil}[pageNo != nil])
    if err != nil {
        return nil, nil, err
    }
    return page.Groups, page.NextToken, nil
}

The above code snippets were just meant to make it easy for you and other colleagues from the community to understand the idea and how to implement it but it may need some tweaks. please feel free to leave a comment in case you need more help.

score 0 · Answer 8 · answered Oct 18 '21 at 03:10

If you are using Amplify and the Auth module, you can call the currentAuthenticatedUser method, and pull the payload information. See below:

import {API, Auth} from "aws-amplify";


export const getCurrentUser = async () => {
  try {
    const userInfo = await Auth.currentAuthenticatedUser({bypassCache:true})
    console.log("User info: ",userInfo)

    if(userInfo){
// returns a Array<strings>
      return userInfo.signInUserSession.idToken.payload["cognito:groups"];
    }
  }

  catch (err) {
    console.log('error: ', err)
  }
}

How do I access the group for a Cognito User account?

8 Answers8

Linked