title: How to use AWS Cognito to secure a .Net Core Web API applications
body: <p>I'm new to AWS and need to secure access to a .NET Core Web API application using Cognito. I'm largely following the excellent video on YouTube by Les Jackson (<a href="https://www.youtube.com/watch?v=3PyUjOmuFic" rel="nofollow noreferrer">https://www.youtube.com/watch?v=3PyUjOmuFic</a>) but he uses Azure rather than AWS.</p>
  <p>So far, I have a very simple API controller action that just pulls some records from SQL Server and sends a JSON response.</p>
  <pre><code>        [HttpGet]
          public async Task&lt;IEnumerable&lt;TodoItem&gt;&gt; Get()
          {
              var items = await context.TodoItem.ToListAsync();
              return items;
          }
  </code></pre>
  <p>This works fine locally in Visual Studio and also when deployed to an AWS instance using Elastic Beanstalk.</p>
  <p>To secure the application I added to the ConfigureServices method in Startup.cs</p>
  <pre><code>    services.AddAuthentication(&quot;Bearer&quot;)
          .AddJwtBearer(options =&gt;
          {
              options.Audience = &quot;App client id&quot;;
              options.Authority = &quot;https://cognito-idp.eu-west-2.amazonaws.com/Cognito User Pool id&quot;;
          });
  </code></pre>
  <p>And in the Configure method</p>
  <pre><code>            app.UseAuthentication();
  </code></pre>
  <p>I added a controller to the application just to authenticate with Cognito and get back an Access token.</p>
  <pre><code>        private const string _clientId = &quot;App client id&quot;;
          private readonly RegionEndpoint _region = RegionEndpoint.EUWest2;
  
          [HttpPost]
          [Route(&quot;/api/signin&quot;)]
          public async Task&lt;ActionResult&lt;string&gt;&gt; SignIn(User user)
          {
              var cognito = new AmazonCognitoIdentityProviderClient(_region);
  
              var request = new AdminInitiateAuthRequest
              {
                  UserPoolId = &quot;Cognito User Pool id&quot;,
                  ClientId = _clientId,
                  AuthFlow = AuthFlowType.ADMIN_USER_PASSWORD_AUTH
              };
  
              request.AuthParameters.Add(&quot;USERNAME&quot;, user.Username);
              request.AuthParameters.Add(&quot;PASSWORD&quot;, user.Password);
  
              var response = await cognito.AdminInitiateAuthAsync(request);
  
              return Ok(response.AuthenticationResult);
          }
  </code></pre>
  <p>After a bit of messing around I've got this working locally and on AWS, returning tokens when a Cognito user name and password are POSTed using Postman, e.g.</p>
  <pre><code>{
      &quot;accessToken&quot;: &quot;.....&quot;,
      &quot;expiresIn&quot;: 3600,
      &quot;idToken&quot;: &quot;...&quot;,
      &quot;newDeviceMetadata&quot;: null,
      &quot;refreshToken&quot;: &quot;...&quot;,
      &quot;tokenType&quot;: &quot;Bearer&quot;
  }
  </code></pre>
  <p>So, I added the [Authorize] attribute to my API method, got an Access Token using the SignIn method and constructed a request in Postman that includes the Authorization HTTP header with the value &quot;Bearer &quot; + accessToken.</p>
  <p>Sadly, this is not working and I can't think of anything else to try.</p>
  <p>Using Postman requests to the application running locally in IIS Express via Visual Studio, I get the response</p>
  <pre><code>System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
   ---&gt; System.IO.IOException: IDX20807: Unable to retrieve document from: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. HttpResponseMessage: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]', HttpResponseMessage.Content: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
  </code></pre>
  <p>When the application is deployed using Elastic Beanstalk I just get a 500 Internal Server Error with no additional messages.</p>
  <p>What am I doing wrong? I would be grateful for any help / pointers.</p>
  <p>Doug</p>