Federated Sign-In with Social and Enterprise Providers
~8 min read
Letting users sign in with an existing Google, Apple, or corporate identity instead of creating a new password.
Cognito User Pools support federated identity providers — social providers like Google, Facebook, and Apple, as well as enterprise providers via SAML 2.0 or OIDC (for integrating with a company's existing corporate identity system, like Azure AD or Okta). When a user chooses to sign in via a federated provider, Cognito handles the OAuth/SAML handshake with that provider, then creates or links a corresponding user record in the User Pool — from the application's perspective, the result is the same: a set of Cognito-issued JWTs, regardless of whether the user signed in with a password or via Google.
This means application code doesn't need separate logic for 'users who signed in with Google' versus 'users who signed in with a password' — Cognito normalizes both into the same token-issuing flow, letting the rest of the application (backend API authorization, Identity Pool credential exchange) work identically regardless of how the user originally authenticated.
Enterprise SAML/OIDC federation is commonly used for internal or B2B applications where a company wants its employees or customer organizations to sign in using their existing corporate credentials (single sign-on) rather than creating and managing separate application-specific passwords.
💬 Deep Dive with AI
Key points
- •Supports social providers (Google, Facebook, Apple) and enterprise SAML/OIDC providers
- •Cognito handles the provider-specific handshake, then issues normalized JWTs regardless of sign-in method
- •Application code doesn't need separate logic per identity provider — the resulting tokens are uniform
- •Enterprise federation enables SSO for B2B or internal applications using existing corporate identity