3

I have an AWS Amplify application that has a structure with multi-organizations:

Organization A -> Content of Organization A Organization B -> Content of Organization B

Let's say we have the user Alice, Alice belongs to both organizations, however, she has different roles in each one, on organization A Alice is an administrator and has more privileges (i.e: can delete content or modify other's content), while on Organization B she is a regular user.

For this reason I cannot simply set regular groups on Amplify (Cognito), because some users, like Alice, can belong to different groups on different organizations.

One solution that I thought was having a group for each combination of organization and role. i.e: OrganizationA__ADMIN, OrganizationB__USER, etc So I could restrict the access on the schema using a group auth directive on the Content model:

{allow: group, groupsField: "group", operations: [update]},

The content would have a group field with a value: OrganizationA__ADMIN

Then I could add the user to the group using the Admin Queries API However, it doesn't seem to be possible to add a user to a group dynamically, I'd have to manually create each group every time a new organization is created, which pretty much kills my idea.

Any other idea on how I can achieve the result I'm aiming for? I know that I can add the restriction on code, but this is less safe, and I'd rather to have this constraint on the database layer.

dfranca
  • 5,156
  • 2
  • 32
  • 60

1 Answers1

2

Look into generating additional claims in you pre-token-generation handler

Basically you can create an attribute that includes organization role mapping

e.g.

{
// ...
  "custom:orgmapping": "OrgA:User,OrgB:Admin"
}

then transform them in your pre-token-generation handler into "pseudo" groups that don't actually exist in the pool.

Andrew Gillis
  • 3,250
  • 2
  • 13
  • 15
  • Thanks! I'll try this and I'll update it here – dfranca Apr 29 '21 at 20:36
  • @dfranca Did this work for you? What did your final solution look like? I have a very similar case and would love to know how you tackled this. – Etep Mar 31 '22 at 20:57
  • @Etep Yes, I have added a edit_groups on my schema that uses the combination of OrgA:ROLE, then I have created a custom pre token generation handler to add the claim with the user Org:Role combination – dfranca Apr 02 '22 at 12:07