https://github.com/dvsa/cognito-migration-lambda
Lambda which is executed when a login request fails on Cognito due to a non-existent user.
https://github.com/dvsa/cognito-migration-lambda
Last synced: 10 months ago
JSON representation
Lambda which is executed when a login request fails on Cognito due to a non-existent user.
- Host: GitHub
- URL: https://github.com/dvsa/cognito-migration-lambda
- Owner: dvsa
- License: mit
- Created: 2021-07-29T14:40:14.000Z (almost 5 years ago)
- Default Branch: main
- Last Pushed: 2024-09-07T08:01:07.000Z (almost 2 years ago)
- Last Synced: 2024-09-07T09:21:59.192Z (almost 2 years ago)
- Language: TypeScript
- Size: 988 KB
- Stars: 1
- Watchers: 13
- Forks: 1
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
# cognito-user-miration-lambda
A Lambda to be invoked by AWS Cognito, to migrate users from an LDAP source.
Can handle both `UserMigration_Authentication` and `UserMigration_ForgotPassword` events from AWS Cognito as referenced in https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html
## Configuration
Configure the Lambda using **environment variables**:
### LDAP_URL
A valid LDAP URL (proto/host/port only).
#### Example
```text
ldap://example.net:389
```
### LDAP_OPERATION_TIMEOUT
Timeout for LDAP operations in milliseconds (default: 5000)
#### Example
```text
10000
```
### LDAP_ADMIN_DN
The FQDN for the admin user to search and obtain user objects.
#### Example
```text
cn=admin,dc=localdev,dc=dvsa
```
### SECRETS_MANAGER_NAME
The "Secret name" as defined in **AWS Secrets Manager**
#### Example
```text
my-secret-stash
```
### SECRETS_MANAGER_KEY_LDAP_ADMIN_PASSWORD
The key which exists in the secret retrieved from **AWS Secrets Manager**
The key should have a value which is the password/credential used to authenticate the ADMIN user.
#### Example
```text
LDAP_ADMIN_PASSWORD
```
#### Pro Tip
The value used in this environment variable can also be defined as another environment variable, if it is defined, the application will use the value in environment variable instead of asking **AWS Secrets Manager**.
This is useful for example for local development. For example (and using the example above), if we define an environment variable `LDAP_ADMIN_PASSWORD` the value in there is used instead of the value from **AWS Secrets Manager**.
_This functionality is provided by https://github.com/dvsa/dvsa-secrets-manager/._
### LDAP_USER_SEARCH_BASE
The LDAP base DN to search the user.
#### Example
```text
dc=example,dc=com
```
### LDAP_USERNAME_ATTRIBUTE
The LDAP search equality attribute name corresponding to the user's username. LDAP_USER_BASE is appended when searching and authenticating.
#### Example
```text
cn
```
### LDAP_OBJECT_FILTER_MAP
JSON string containing a filter map transforming the object from LDAP to Cognito user attributes:
**Key:** LDAP entry field => **Value:** Cognito user attribute field
Attributes not defined are ignored and not given to Cognito.
#### Example
```json
{
"mail": "email",
"cn": "username"
}
```
## Requirements
- node v18.*
- [SAM CLI](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html)
## Build
- `npm i`
- `npm run build:dev`
## Watch
To watch for changes and automatically trigger a new build:
- `npm run watch:dev`
## Run Lambdas Locally
- Ensure you have an LDAP instance running (`docker-compose up`)
- Build the files first
- Set environment variables in `env.json` (see `env.example.json` for an example)
- To run CloudWatch Event lambdas:
```
npm run invoke -- --env-vars env.json -e ./event/userMigrationAuthenticationTriggerEvent.event.json
```
## Tests
- The [Jest](https://jestjs.io/) framework is used to run tests and collect code coverage
- To run the tests, run the following command within the root directory of the project: `npm test`
- Coverage results will be displayed on terminal and stored in the `coverage` directory
- The coverage requirements can be set in `jest.config.js`