Add Authentik IdP groups to Cognito JWT

gistfile1.txt

export const handler = function(event, context) {
  // Log the incoming user attributes for debugging
  console.debug(event);

  // Extract the custom:idpgroups claim
  const externalUserGroupsString = event.request.userAttributes['custom:idpgroups'];

  // Parse the stringified array
  const externalUserGroups = JSON.parse(externalUserGroupsString);
  console.debug("External user groups:", externalUserGroups);

  // Remove the "myapp-" prefix for each group
  const unprefixedGroups = externalUserGroups.map(group => group.replace('myapp-', ''));
  console.debug("Unprefixed groups:", unprefixedGroups);

  // Extract the cognito:groups claim
  const cognitoUserGroups = event.request.groupConfiguration.groupsToOverride;
  console.log("Cognito user groups:", cognitoUserGroups);

  // Append the cleaned groups to the current 

  if (unprefixedGroups) {
    // Append unprefixedGroups to cognitoUserGroups
    const updatedGroups = [...cognitoUserGroups, ...unprefixedGroups];
  
    event.response = {
      claimsAndScopeOverrideDetails: {
        groupOverrideDetails: {
            groupsToOverride: updatedGroups
        }
      }
    };
  }

  context.done(null, event);
};