# C# Lambda Get Cognito Identity **URL:** \ **Category:** Serverless Framework\ **Tags:** aws\ **Created:** [April 4, 2017, 12:14pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627 "2017-04-04T12:14:30Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![barticus](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@barticus](https://forum.serverless.com/u/barticus)\ **Post date:** [April 4, 2017, 12:14pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/1 "2017-04-04T12:14:30Z")
Hi, I’ve created some serverless functions that use a cognito user pool as the authorizer. I can successfully call the lambdas behind them. What i can’t seem to work out is how to get the “sub”, or any identifier for that matter, of the caller of the lambda. The serverless documentation points out that they have mapped to the “identity” field of the request, but this is null when i read it in. The lambda documentation says they have an Identity property of the ILambdaContext class. This is not null, but the values for IdentityId and IdentityPoolId are empty. Some googling found some people suggesting to use AWS\_IAM rather than Cognito as the authorizer, however i don’t think this is right for my use case as i want the ID of the caller, not just to know they are authenticated. This may be that C# is not yet fully featured by serverless? Does anyone have any advice? Thanks, ---
**Author:** ![barticus](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@barticus](https://forum.serverless.com/u/barticus)\ **Post date:** [April 5, 2017, 12:12pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/2 "2017-04-05T12:12:20Z")
I’ve found the solution to this, details about the claimed identity are available as part of the “requestContext” attribute. Sample" ``` "requestContext": { "accountId": "1234", "resourceId": "abc", "stage": "dev", "authorizer": { "claims": { "sub": "sub", "aud": "aud", "email_verified": "true", "token_use": "id", "auth_time": "1234", "iss": "https://cognito-idp.ap-northeast-1.amazonaws.com/user_pool_id", "cognito:username": "you@email.com", "exp": "Wed Apr 05 12:50:18 UTC 2017", "iat": "Wed Apr 05 11:50:18 UTC 2017", "email": "you@email.com" } }, "requestId": "1234-1234-1234", "identity": { "cognitoIdentityPoolId": null, "accountId": null, "cognitoIdentityId": null, "caller": null, "apiKey": null, "sourceIp": "220.244.228.54", "accessKey": null, "cognitoAuthenticationType": null, "cognitoAuthenticationProvider": null, "userArn": null, "userAgent": "agent-string", "user": null }, "resourcePath": "/api/do", "httpMethod": "POST", "apiId": "abc123" }, "body": "{field:'value'}" ``` interesting/disappointing that “identity” is not populated at all. Hope this helps someone. ---
**Author:** ![bbilger](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bbilger/32/1066_2.png) [@bbilger](https://forum.serverless.com/u/bbilger)\ **Post date:** [April 5, 2017, 7:18pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/3 "2017-04-05T19:18:00Z")
Hi @barticus, IMO “serverless” is mainly a tool to deploy your function(s) and doesn’t limit what your function(s) can do. If you protect your endpoint with a “Cognito Authorizer” and assuming you use lambda proxy integration and you pass the ID token as a request header, then you should be able to get the “sub” claim as follows: ```auto .requestContext.authorizer.claims.sub ``` (edit: it’s requestContext and not context) see [AWS’ mapping reference](http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html) In case it helps, here is a Java example for my framework [JRestless](https://github.com/bbilger/jrestless) that also explains how to set everything up: [aws-gateway-security-cognito-authorizer](https://github.com/bbilger/jrestless-examples/tree/master/aws/gateway/aws-gateway-security-cognito-authorizer) The cognito related data in the lambda context (ILambdaContext in case of C#) as well as in “yourRequestObject.context.identity…” will only be set if you invoke your API Gateway endpoint through the AWS SDK and you use “Cognito (Federated) Identity” (working on an example for this for [JRestless](https://github.com/bbilger/jrestless), as well 😉 ). Hope this helps. ---
**Author:** ![VictorioBerra](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/victorioberra/32/1217_2.png) [@VictorioBerra](https://forum.serverless.com/u/VictorioBerra)\ **Post date:** [August 20, 2017, 9:28pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/4 "2017-08-20T21:28:31Z")
> The cognito related data in the lambda context (ILambdaContext in case of C#) as well as in “yourRequestObject.context.identity…” will only be set if you invoke your API Gateway endpoint through the AWS SDK and you use “Cognito (Federated) Identity” (working on an example for this for JRestless2, as well 😉 ). This was really confusing for me too. You would think since they have a shiny button in the console for using Cognito Pools as an authorizer they would fill out all that for us instead of just dumping the claims. In NodeJS this is the output when I invoke my API via postman ```auto "identity": { "cognitoIdentityPoolId": null, "accountId": null, "cognitoIdentityId": null, "caller": null, "apiKey": "", "sourceIp": "REDACTED", "accessKey": null, "cognitoAuthenticationType": null, "cognitoAuthenticationProvider": null, "userArn": null, "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3175.3 Safari/537.36", "user": null }, ``` Furthermore, if you used Federated Identities to get IAM creds to auth with the api via sig4 how does the API know who the user is? Do you have an example of how to invoke api gateway endpoints using “Cognito (Federated) Identity” so that those properties are not null? ---
**Author:** ![barticus](https://avatars.discourse-cdn.com/v4/letter/b/ac91a4/32.png) [@barticus](https://forum.serverless.com/u/barticus)\ **Post date:** [August 21, 2017, 10:31am UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/5 "2017-08-21T10:31:37Z")
Hi VictorioBerra, I don’t think this is possible, when you get iam creds you are assuming a particular iam role, and are thus acting as that role rather than as the user you assumed the credentials with. In my application, i don’t get IAM creds or use the sig4 authentication, once you have authenticated the user directly with cognito you will get a JWT which you supply as your authorization header and thats all there is to it. API Gateway gives you a little tool to validate that a token is valid for it. It depends on what language you are using for your front end, I am using javascript so [this project](https://github.com/aws/amazon-cognito-identity-js) was a great reference i looked at when creating my interactions between cognito, and then to API gateway. Hope that helps. ---
**Author:** ![bbilger](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bbilger/32/1066_2.png) [@bbilger](https://forum.serverless.com/u/bbilger)\ **Post date:** [August 21, 2017, 8:19pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/6 "2017-08-21T20:19:16Z")
Hi @VictorioBerra , It’s a little difficult to present you a full example, here. In general you need an Identity Pool and use that to log your user in using the SDK. If you also use a User Pool as an authentication provider and want to invoke your APIGW through JS, later, you may find “Use Case 17” [here](https://github.com/aws/amazon-cognito-identity-js) useful. Once you managed to log users in, you furthermore need to generate an SDK for your APIGW and invoke the endpoints through it. You may find this useful: [Invoke API Gateway function with Cognito Authentication from Javascript](http://forum.serverless.com/t/invoke-api-gateway-function-with-cognito-authentication-from-javascript/1451/5) Note: the “cognitoIdentityId” will be the “user’s” ID in the Identity Pool; not the User Pool. ---
**Author:** ![VictorioBerra](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/victorioberra/32/1217_2.png) [@VictorioBerra](https://forum.serverless.com/u/VictorioBerra)\ **Post date:** [August 22, 2017, 5:22pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/7 "2017-08-22T17:22:39Z")
Whats the difference between these? > **[aws/amazon-cognito-auth-js](https://github.com/aws/amazon-cognito-auth-js)** > > amazon-cognito-auth-js - The Amazon Cognito Auth SDK for JavaScript simplifies adding sign-up, sign-in with user profile functionality to web apps. > **[aws/amazon-cognito-identity-js](https://github.com/aws/amazon-cognito-identity-js)** > > amazon-cognito-identity-js - Amazon Cognito Identity SDK for JavaScript ---
**Author:** ![VictorioBerra](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/victorioberra/32/1217_2.png) [@VictorioBerra](https://forum.serverless.com/u/VictorioBerra)\ **Post date:** [August 22, 2017, 11:27pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/8 "2017-08-22T23:27:07Z")
Okay everyone I got it working. Here is what I did. # In the AWS Console - Create a lambda function - Create a user pool - Create a user for yourself and verify the email. We will change the password later - Create a client app. Uncheck the client secret checkbox - Create a federated identity (that uses the user pool) - Create/Edit Authed and Unauthed roles - On the Authed role, go to IAM and add a managed policy to allow full access to invoke APIG - Create an API Gateway resource and a method (ANY) - Use lambda as the integration, proxy requests to it - Enable CORS on resource - Set Authorization to AWS\_IAM # In your code Auth and get creds. There are a number of ways to do this. Now that you have a user pool you can use the front-end library [amazon-cognito-identity-js](https://github.com/aws/amazon-cognito-identity-js) this will allow you to authenticate and get a JWT (call `authenticate()` with the above library). With the JWT you can use the [CognitoIdentityCredentials](http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CognitoIdentityCredentials.html) and `config.credentials.get` to actually populate the `AccessKeyId` and `SecretAccessToken` and `SessionToken`. **FINALLY** use Postman (NOT THE CHROME APP, you must download the desktop app) to call your APIG and there you go! ![Postman](https://yyz2.discourse-cdn.com/flex036/uploads/serverless/original/1X/3b3ed4a18178ca1857d86ab7b02797e6453a2cfc.png) I have some code samples and blog posts coming soon. I have to clean up my code a lot and move hardcoded stuff to text inputs. ---
**Author:** ![logemann](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/logemann/32/1885_2.png) [@logemann](https://forum.serverless.com/u/logemann)\ **Post date:** [June 1, 2018, 11:00am UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/9 "2018-06-01T11:00:36Z")
any news on your blog posts? I am on my way too and any more infos are badly needed… 😉 ---
**Author:** ![VictorioBerra](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/victorioberra/32/1217_2.png) [@VictorioBerra](https://forum.serverless.com/u/VictorioBerra)\ **Post date:** [June 1, 2018, 1:12pm UTC](https://forum.serverless.com/t/c-lambda-get-cognito-identity/1627/10 "2018-06-01T13:12:42Z")
Its been a while since I worked on this, but i think this is what you want: > My github code samples: > **[GitHub - VictorioBerra/js-cognito-auth-example: Javascript Cognito...](https://github.com/VictorioBerra/js-cognito-auth-example)** > > Javascript Cognito Identity/Pool Authenticator Example - GitHub - VictorioBerra/js-cognito-auth-example: Javascript Cognito Identity/Pool Authenticator Example