Network.AWS.CognitoIdentityProvider.AdminLinkProviderForUser

Links an existing user account in a user pool (DestinationUser ) to an identity from an external identity provider (SourceUser ) based on a specified attribute name and value from the external identity provider. This allows you to create a link from the existing user account to an external federated user identity that has not yet been used to sign in, so that the federated user identity can be used to sign in as the existing user account.

For example, if there is an existing user with a username and password, this API links that user to a federated user identity, so that when the federated user identity is used, the user signs in as the existing user account.

Important: Because this API allows a user with an external federated identity to sign in as an existing user in the user pool, it is critical that it only be used with external identity providers and provider attributes that have been trusted by the application owner.

See also AdminDisableProviderForUser .

This action is enabled only for admin access and requires developer credentials.

Creating a Request

adminLinkProviderForUser

Arguments

:: Text

alpfuUserPoolId

-> ProviderUserIdentifierType

alpfuDestinationUser

-> ProviderUserIdentifierType

alpfuSourceUser

-> AdminLinkProviderForUser

Creates a value of AdminLinkProviderForUser with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• alpfuUserPoolId - The user pool ID for the user pool.
• alpfuDestinationUser - The existing user in the user pool to be linked to the external identity provider user account. Can be a native (Username + Password) Cognito User Pools user or a federated user (for example, a SAML or Facebook user). If the user doesn't exist, an exception is thrown. This is the user that is returned when the new user (with the linked identity provider attribute) signs in. The ProviderAttributeValue for the DestinationUser must match the username for the user in the user pool. The ProviderAttributeName will always be ignored.
• alpfuSourceUser - An external identity provider account for a user who does not currently exist yet in the user pool. This user must be a federated user (for example, a SAML or Facebook user), not another native user. If the SourceUser is a federated social identity provider user (Facebook, Google, or Login with Amazon), you must set the ProviderAttributeName to Cognito_Subject . For social identity providers, the ProviderName will be Facebook , Google , or LoginWithAmazon , and Cognito will automatically parse the Facebook, Google, and Login with Amazon tokens for id , sub , and user_id , respectively. The ProviderAttributeValue for the user must be the same value as the id , sub , or user_id value found in the social identity provider token. For SAML, the ProviderAttributeName can be any value that matches a claim in the SAML assertion. If you wish to link SAML users based on the subject of the SAML assertion, you should map the subject to a claim through the SAML identity provider and submit that claim name as the ProviderAttributeName . If you set ProviderAttributeName to Cognito_Subject , Cognito will automatically parse the default unique identifier found in the subject from the SAML token.

data AdminLinkProviderForUser

See: adminLinkProviderForUser smart constructor.

Instances

Eq AdminLinkProviderForUser

Methods

(==) :: AdminLinkProviderForUser -> AdminLinkProviderForUser -> Bool

(/=) :: AdminLinkProviderForUser -> AdminLinkProviderForUser -> Bool

Data AdminLinkProviderForUser

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> AdminLinkProviderForUser -> c AdminLinkProviderForUser

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c AdminLinkProviderForUser

toConstr :: AdminLinkProviderForUser -> Constr

dataTypeOf :: AdminLinkProviderForUser -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c AdminLinkProviderForUser)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c AdminLinkProviderForUser)

gmapT :: (forall b. Data b => b -> b) -> AdminLinkProviderForUser -> AdminLinkProviderForUser

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> AdminLinkProviderForUser -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> AdminLinkProviderForUser -> r

gmapQ :: (forall d. Data d => d -> u) -> AdminLinkProviderForUser -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> AdminLinkProviderForUser -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUser -> m AdminLinkProviderForUser

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUser -> m AdminLinkProviderForUser

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUser -> m AdminLinkProviderForUser

Read AdminLinkProviderForUser

Methods

readsPrec :: Int -> ReadS AdminLinkProviderForUser

readList :: ReadS [AdminLinkProviderForUser]

readPrec :: ReadPrec AdminLinkProviderForUser

readListPrec :: ReadPrec [AdminLinkProviderForUser]

Show AdminLinkProviderForUser

Methods

showsPrec :: Int -> AdminLinkProviderForUser -> ShowS

show :: AdminLinkProviderForUser -> String

showList :: [AdminLinkProviderForUser] -> ShowS

Generic AdminLinkProviderForUser

Associated Types

type Rep AdminLinkProviderForUser :: * -> *

Methods

from :: AdminLinkProviderForUser -> Rep AdminLinkProviderForUser x

to :: Rep AdminLinkProviderForUser x -> AdminLinkProviderForUser

Hashable AdminLinkProviderForUser

Methods

hashWithSalt :: Int -> AdminLinkProviderForUser -> Int

hash :: AdminLinkProviderForUser -> Int

ToJSON AdminLinkProviderForUser

Methods

toJSON :: AdminLinkProviderForUser -> Value

toEncoding :: AdminLinkProviderForUser -> Encoding

toJSONList :: [AdminLinkProviderForUser] -> Value

toEncodingList :: [AdminLinkProviderForUser] -> Encoding

NFData AdminLinkProviderForUser

Methods

rnf :: AdminLinkProviderForUser -> ()

AWSRequest AdminLinkProviderForUser

Associated Types

type Rs AdminLinkProviderForUser :: *

Methods

request :: AdminLinkProviderForUser -> Request AdminLinkProviderForUser

response :: MonadResource m => Logger -> Service -> Proxy * AdminLinkProviderForUser -> ClientResponse -> m (Response AdminLinkProviderForUser)

ToQuery AdminLinkProviderForUser

Methods

toQuery :: AdminLinkProviderForUser -> QueryString

ToPath AdminLinkProviderForUser

Methods

toPath :: AdminLinkProviderForUser -> ByteString

ToHeaders AdminLinkProviderForUser

Methods

toHeaders :: AdminLinkProviderForUser -> [Header]

type Rep AdminLinkProviderForUser

type Rep AdminLinkProviderForUser = D1 (MetaData "AdminLinkProviderForUser" "Network.AWS.CognitoIdentityProvider.AdminLinkProviderForUser" "amazonka-cognito-idp-1.5.0-6L4ibyApQsq9OINZIpqhIF" False) (C1 (MetaCons "AdminLinkProviderForUser'" PrefixI True) ((:*:) (S1 (MetaSel (Just Symbol "_alpfuUserPoolId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) ((:*:) (S1 (MetaSel (Just Symbol "_alpfuDestinationUser") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 ProviderUserIdentifierType)) (S1 (MetaSel (Just Symbol "_alpfuSourceUser") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 ProviderUserIdentifierType)))))

type Rs AdminLinkProviderForUser

type Rs AdminLinkProviderForUser = AdminLinkProviderForUserResponse

Request Lenses

alpfuUserPoolId :: Lens' AdminLinkProviderForUser Text

The user pool ID for the user pool.

alpfuDestinationUser :: Lens' AdminLinkProviderForUser ProviderUserIdentifierType

The existing user in the user pool to be linked to the external identity provider user account. Can be a native (Username + Password) Cognito User Pools user or a federated user (for example, a SAML or Facebook user). If the user doesn't exist, an exception is thrown. This is the user that is returned when the new user (with the linked identity provider attribute) signs in. The ProviderAttributeValue for the DestinationUser must match the username for the user in the user pool. The ProviderAttributeName will always be ignored.

alpfuSourceUser :: Lens' AdminLinkProviderForUser ProviderUserIdentifierType

An external identity provider account for a user who does not currently exist yet in the user pool. This user must be a federated user (for example, a SAML or Facebook user), not another native user. If the SourceUser is a federated social identity provider user (Facebook, Google, or Login with Amazon), you must set the ProviderAttributeName to Cognito_Subject . For social identity providers, the ProviderName will be Facebook , Google , or LoginWithAmazon , and Cognito will automatically parse the Facebook, Google, and Login with Amazon tokens for id , sub , and user_id , respectively. The ProviderAttributeValue for the user must be the same value as the id , sub , or user_id value found in the social identity provider token. For SAML, the ProviderAttributeName can be any value that matches a claim in the SAML assertion. If you wish to link SAML users based on the subject of the SAML assertion, you should map the subject to a claim through the SAML identity provider and submit that claim name as the ProviderAttributeName . If you set ProviderAttributeName to Cognito_Subject , Cognito will automatically parse the default unique identifier found in the subject from the SAML token.

Destructuring the Response

adminLinkProviderForUserResponse

Arguments

:: Int

alpfursResponseStatus

-> AdminLinkProviderForUserResponse

Creates a value of AdminLinkProviderForUserResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• alpfursResponseStatus - -- | The response status code.

data AdminLinkProviderForUserResponse

See: adminLinkProviderForUserResponse smart constructor.

Instances

Eq AdminLinkProviderForUserResponse

Methods

(==) :: AdminLinkProviderForUserResponse -> AdminLinkProviderForUserResponse -> Bool

(/=) :: AdminLinkProviderForUserResponse -> AdminLinkProviderForUserResponse -> Bool

Data AdminLinkProviderForUserResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> AdminLinkProviderForUserResponse -> c AdminLinkProviderForUserResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c AdminLinkProviderForUserResponse

toConstr :: AdminLinkProviderForUserResponse -> Constr

dataTypeOf :: AdminLinkProviderForUserResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c AdminLinkProviderForUserResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c AdminLinkProviderForUserResponse)

gmapT :: (forall b. Data b => b -> b) -> AdminLinkProviderForUserResponse -> AdminLinkProviderForUserResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> AdminLinkProviderForUserResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> AdminLinkProviderForUserResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> AdminLinkProviderForUserResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> AdminLinkProviderForUserResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUserResponse -> m AdminLinkProviderForUserResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUserResponse -> m AdminLinkProviderForUserResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> AdminLinkProviderForUserResponse -> m AdminLinkProviderForUserResponse

Read AdminLinkProviderForUserResponse

Methods

readsPrec :: Int -> ReadS AdminLinkProviderForUserResponse

readList :: ReadS [AdminLinkProviderForUserResponse]

readPrec :: ReadPrec AdminLinkProviderForUserResponse

readListPrec :: ReadPrec [AdminLinkProviderForUserResponse]

Show AdminLinkProviderForUserResponse

Methods

showsPrec :: Int -> AdminLinkProviderForUserResponse -> ShowS

show :: AdminLinkProviderForUserResponse -> String

showList :: [AdminLinkProviderForUserResponse] -> ShowS

Generic AdminLinkProviderForUserResponse

Associated Types

type Rep AdminLinkProviderForUserResponse :: * -> *

Methods

from :: AdminLinkProviderForUserResponse -> Rep AdminLinkProviderForUserResponse x

to :: Rep AdminLinkProviderForUserResponse x -> AdminLinkProviderForUserResponse

NFData AdminLinkProviderForUserResponse

Methods

rnf :: AdminLinkProviderForUserResponse -> ()

type Rep AdminLinkProviderForUserResponse

type Rep AdminLinkProviderForUserResponse = D1 (MetaData "AdminLinkProviderForUserResponse" "Network.AWS.CognitoIdentityProvider.AdminLinkProviderForUser" "amazonka-cognito-idp-1.5.0-6L4ibyApQsq9OINZIpqhIF" True) (C1 (MetaCons "AdminLinkProviderForUserResponse'" PrefixI True) (S1 (MetaSel (Just Symbol "_alpfursResponseStatus") NoSourceUnpackedness NoSourceStrictness DecidedLazy) (Rec0 Int)))

Response Lenses

alpfursResponseStatus :: Lens' AdminLinkProviderForUserResponse Int

• - | The response status code.