Configure user pools with different providers

Creating user pools in Frontegg—either from external sources or via Identity Providers (IdPs)—provides flexibility and control over user management. External pools integrate user data from external databases or custom code, ensuring smooth migration. IdP pools leverage existing credentials for authentication through trusted providers, enhancing security without requiring user migration. This topic outlines use cases for setting up user pools via external sources or IdPs like Auth0, Amazon Cognito, and Google Firebase.

External user pools

Auth0

When creating an Auth0 user pool, you must perform several actions on your Auth0 account to ensure proper configuration and sync of this pool with Frontegg:

1. Go to your Auth0 account and to your Applications view.

2. Go to your app → Credentials tab → and choose the Client Secret (Post) Method.

3. Go to your Advanced Settings → Grant Types tab, and check the box next to the Password option

4. Go to Applications → APIs → Auth0 Management API → Machine to Machine Applications tab and Authorize your app via the toggle.

5. Open the dropdown menu and select the permissions you want to give the app. Check the read:users and read:roles permissions' boxes. Click the Update button to finalize the configuration.

6. Users Page → [USER] → app_metadata → tenantId: frontegg_tenant_id

7. To map user roles, add the role on Auth0 - set the name of the role as the same keyof the corresponding Frontegg role.

Custom code

You can choose to fetch user pools from external resources via custom code, which is available under the Other Source option.

Amazon Cognito

You can create user pools originating in your Amazon Cognito account. To allow proper synching of your Cognito users into Frontegg's user pool, you will need to adhere to the following guidelines:

1. Each user on Amazon Cognito's side should have a custom attribute where the Name of the attribute should be identical to the value of the custom:<tenantIdFieldName> that was used in the pool’s configuration.

2. Next, in the Edit User section (Amazon Cognito > User Pools) , under the Optional attributes section, then enter the ID of the relevant Frontegg tenant as the Value of the custom:tenantId :

3. Go to the Edit app client information to enable the ALLOW_USER_PASSWORD_AUTH authentication flow, like so:

4. If your Cognito app is using a client secret, you should include it when configuring the pool (the Frontegg clientSecret field).

{
  "region": "<AWS_REGION>",
  "clientId": "...", // the client id of the cognito application
  "userPoolId": "...", // the id of the cognito pool
  "clientSecret": "...", //optional
  "tenantIdFieldName": "...",
  "accessKeyId": "...",
  "secretAccessKey": "..."
 }

5. Each user should have a custom attribute as such:

Google Firebase

1. To create a user pool from your Google Firebase account you will need to get a Web API Key and a Private key from your Firebase project.

Go to your Firebase project and copy your Web API Key from the General tab:

2. Then, go to the service account tab and press the Generate new private key button. Open the downloaded file with your textEditor and copy the key.

3. Then, head over to the Frontegg portal → [ENVIRONMENT] → Management → User pools. Click on Create user pool. Select the External User pool type.

4. Select the Firebase option and paste the API key and Private key from your Firebase account into the API Key and _Firebase service account _fields, respectively.

IdP user pools

Auth0

To create an IdP user pool with Auth0, please complete the following steps:

1. To properly create a user pool from Auth0, we expect the tenantId to be part of the idToken. To do that, you will need to include your tenantId from the user's Metadata within your app's app_metadata, like so:

2. Next, go to your Auth0 account, Go to the Actions → Flows tab, and choose the Login option.

Once the required configuration on Auth0 is completed, proceed to create a new user pool in Frontegg by following the requirements listed in the External User Pools section.