Kanject.Identity

A typed .NET surface over AWS Cognito — user and group management, password, one-time-code and Apple or Google sign-in, plus a permission model your services enforce — running against a Cognito user pool in your AWS account.

Provision

Identity runs against a Cognito user pool and its app client(s) in your account, and it never creates them — prepare these resources before starting the service. Create one pool per stage in the infrastructure-as-code you already run (CloudFormation, CDK, Terraform) or the AWS console, then pass its IDs to the module as UserPoolId and ClientId.

Register it in your service

Registration is generic over three types you own — the data context (derived from IdentityDbContext<TUser, TGroup>), your application user, and your user group — and takes a typed AwsCognitoConfiguration delegate, whose IdentityDynamoDbConfig points the data context at its DynamoDB table. The NuGet package is provider-versioned (Kanject.Identity.Provider.AwsCognitoV4).

using Kanject.Core.Api.Abstractions.Interfaces;using Kanject.Core.NoSqlDatabase.Provider.DynamoDb.Abstractions.DataContext;using Kanject.Identity.Provider.AwsCognitoV4.DbContext;using Kanject.Identity.Provider.AwsCognitoV4.Extensions;​// Your own user, group, and data-context types (the three generics).public sealed class AppUser : IApplicationUser { /* your profile fields */ }public sealed class AppUserGroup : IApplicationUserGroup { /* Id, Name, Permissions */ }public class AppIdentityDbContext : IdentityDbContext<AppUser, AppUserGroup>;​builder.Services.AddCognitoIdentityProvider<AppIdentityDbContext, AppUser, AppUserGroup>(    options =>    {        options.Region     = appSettings.AwsRegion;        options.UserPoolId = appSettings.CognitoUserPoolId;        options.ClientId   = appSettings.CognitoClientId;​        // The DynamoDB table behind the data context (required).        options.IdentityDynamoDbConfig = new DynamoDbConfig        {            AwsRegion = appSettings.AwsRegion,            Namespace = appSettings.Stage,   // per-stage isolation            TableName = "identity",        };    });​// Add the authorization server to enable [RequiresPermission] enforcement.builder.Services.AddAuthorizationServer();

Register users, run auth flows

Inject IUserIdentityService<TApplicationUser, TApplicationUserGroup>. Its methods take request objects (not loose strings): RegisterUserAsync<T> creates a Cognito user and places them in a group; UserAuthenticationAsync<T> runs the sign-in flow and returns a typed token response.

// Inject the typed identity service (generic over your user + group types).public class AccountService(IUserIdentityService<AppUser, AppUserGroup> identity){    public Task<AppUser> RegisterAsync(RegisterAppUserRequest request)        // request implements IRegisterUserRequest, IAddUserToGroupRequest        => identity.RegisterUserAsync(request);​    public Task<TokenWithUserAuthenticationFlowResponse> SignInAsync(SignInRequest request)        => identity.UserAuthenticationAsync(request);}

Protect endpoints

Cognito-issued JWTs validate through standard ASP.NET Core authentication. For authorization, the SDK ships a [RequiresPermission] action filter backed by AddAuthorizationServer() — a permission/group model synced to DynamoDB — rather than only role strings.

// Protect endpoints with the permission filter (backed by the authorization// server + a permission/group model synced to DynamoDB).[RequiresPermission("reports.read")][HttpGet("/admin/reports")]public IActionResult Reports() => Ok();

What you get

• Cognito user pool — sign-up, sign-in, and token flows against a pool in your account
• Typed service — IUserIdentityService<TUser, TGroup> with request-object methods for users and groups
• Groups & permissions — a permission/group model enforced via [RequiresPermission] + the authorization server
• One-time codes & social sign-in — passwordless six-digit codes (the SDK issues them, you deliver them), and Apple or Google sign-in linked to a user by email
• Sessions — optional session management via Kanject.Identity.Extensions.Sessions
• Provider versions — Cognito providers V1–V4; register the version your service targets

Related modules