Signing in through the Hub

Products you install with the Hub can sign people in through the Hub. Your users then sign in to a product with the same account they use for the Hub, and get single sign-on across every product installed this way. It is an extra option, never a replacement: every other sign-in method works as before.

#How it works

The Hub signs people in with its own Amazon Cognito user pool, through IAM Identity Center, SAML, OIDC or Cognito users, whichever the Hub's IdentityProvider is. A product installed with sign-in through the Hub trusts that user pool as an OpenID Connect provider.

For each product stack that uses it, the Hub:

• creates an app client in its user pool named cc-hub-<stack name>, with a secret, or updates the one that already exists;
• stores the client secret in AWS Secrets Manager as cc-hub-<stack name>-oidc-client;
• installs or updates the product with IdentityProvider set to CloudCertaintyHub, and fills in the product's OidcIssuer (the Hub's user pool), OidcClientId, OidcClientSecretArn and OidcEmailVerifiedClaim (email_verified), and leaves SamlMetadataUrl empty.

Products trust a user's email only when it is verified, and many give access by group. So the Hub keeps two attributes on its users: it marks the email as verified for people who sign in through IAM Identity Center or another SAML identity provider, and it turns the group IDs IAM Identity Center sends into readable group names. A product's group rules can then use names such as CloudCertaintyHubAdmins.

The Hub records each sign-in client it creates or updates in its audit log.

#When it is available

The option appears when the product's template offers CloudCertaintyHub as an IdentityProvider value. Products add it release by release. For a product whose template does not offer it yet, the install form says why the option is missing.

#Turn it on

1. Install the product, or open Update / change settings on its stack page.
2. At the top of the identity settings, choose Sign in through Cloud Certainty Hub. The Hub fills in the sign-in parameters, so the form hides them.
3. Choose Review changes, check the change set, and choose Execute.

Everyone who can sign in to the Hub can then sign in to the product. The product's own rules decide what each of them may do there.

Exporting with the option on works too, with one difference: the export creates or updates the app client and the secret straight away, because the exported stack needs them.

#Existing sign-in options keep working

• The products' default sign-in method does not change.
• IAMIdentityCenter, SAML, OIDC and CognitoOnly work exactly as before, in the Hub and outside it.
• Products installed without the Hub see no change, and existing stacks are not touched.
• Moving a product to or from sign-in through the Hub is a normal stack update.

#Turn it off

Open Update / change settings on the product's stack page and choose Choose another sign-in method, then fill in the method you want. Because users will sign in differently afterwards, the form asks you to confirm that you understand before you can review the change. After the update, the Hub account no longer opens the product.

The app client and the secret stay in place. They are harmless, and you can delete them yourself: the secret in Secrets Manager, and the app client in the Hub's Cognito user pool.

#Before you delete the Hub

A product that signs people in through the Hub needs the Hub's user pool, which is deleted with the Hub's stack. Move every such product to another sign-in method before you uninstall the Hub.