Replace Cognito User Pool with Open Source Choices

[goodbyedavid]

Hi Team,

Currently saas boost uses Cognito UserPools to manage identities for the Admin UI. One challenge we are facing now is UserPools as a service is not available for all regions, like GCR(great china region). In China from the aws solutions architect team's view, we believe there are huge interest for SaaS boost, and we'd like to see if it is possible to enable an open source option like KeyCloak for Admin UI user management. As we are still in the exploring phase, I'd like to seek advises regarding the following questions:

1. Is UserPool solely used for Admin UI user management?
2. Do you think UserPool can be replaced by other options? If yes, how complicated will it be?
3. Any go-to person I can have a deeper conversation regarding this topic?

Thanks,
David

[PoeppingT]

Hi @goodbyedavid , and welcome to the SaaS Boost discussion forum! Your point is a good one: the services that Boost uses (non-comprehensive list here) will constrain Boost to the maximal set of restrictions on those services. Currently GCR is not supported with SaaS Boost.

To answer your questions directly:

1. The UserPool is used to both control access to the Admin UI and authenticate requests to the Boost Control Plane's API (e.g. onboarding a new tenant, getting the current environment application configuration, disabling an onboarded tenant) and so cannot simply be removed.
2. The UserPool can be replaced with other options but there is significant development work needed to accomplish this:
   • the tree of CloudFormation stacks needs to either create the open source UserPool resource (preferred, so environment resources are isolated) or needs to know how to access it and hook that information into the rest of Boost. the current UserPool is created as part of saas-boost-web.yaml and passed to other stacks as a Parameter from the base stack saas-boost.yaml. An alternate integration may be developed using a custom CloudFormation ResourceType to stand up a cloud-based installation of your open source solution
   • the Boost User service (used for controlling the UI and granting access to the APIs) is currently built around Cognito and would need to be reworked to integrate with your UserPool solution. the User Service CloudFormation template (saas-boost-svc-user.yaml) receives the UserPool as a parameter to provide as an environment variable to functions and provide proper least-access permissions, and the User Service Data Access Layer (UserServiceDAL.java) assumes Cognito is the user authorization provider
   • the public API Gateway is currently authorized with the Cognito UserPool (see saas-boost-public-api.yaml) and a new custom authorizer (more details here) would need to be developed to instead authorize against your chosen service
3. You've already found the best place for an in-depth conversation about this topic! These discussion forums are great for the community: not only does it provide a history of information for new users to review, it also provides the development team with a way to keep members like you up to date on improvements.

If you're interested in helping develop SaaS Boost to be able to support GCR, please don't hesitate to open issues and PRs against the repository. With issue creation and interaction the development team can build a better understanding of our customer's pain points to prioritize development work to target improving SaaS Boost for our widest group of customers.

[goodbyedavid]

Thanks @PoeppingT for the very detailed answering of my question, I'd like to look into what you've mentioned here before I can reply with more specific questions/issues. This is very helpful.

[goodbyedavid]

There seems to have more components than what you've mentioned. The admin react application itself uses Amplify SDK to setup the authentication framework. My understanding is this Amplify integration also needs to get updated with the 3rd party tool .