Use OpenID Connect as an authorization provider
Private, owner, and group authorization can be configured with an OpenID Connect (OIDC) authorization mode. Add "oidc" to the authorization rule as the provider. Use the oidcAuthorizationMode property to configure the OpenID Connect provider name, OpenID Connect provider domain, Client ID, Issued at TTL, and Auth Time TTL.
The example below highlights the supported authorization strategies with a oidc authorization provider. For owner and group-based authorization, you also will need to specify a custom identity and group claim.
amplify/data/resource.ts
// amplify/data/resource.tsimport { a, defineData, type ClientSchema } from '@aws-amplify/backend';
const schema = a.schema({ Todo: a .model({ content: a.string(), }) .authorization(allow => [ allow.owner('oidc').identityClaim('user_id'), allow.authenticated('oidc'), allow .groups(['testGroupName'], 'oidc') .withClaimIn('user_groups'), ]),});
export type Schema = ClientSchema<typeof schema>;
export const data = defineData({ schema, authorizationModes: { defaultAuthorizationMode: 'oidc', oidcAuthorizationMode: { oidcProviderName: 'oidc-provider-name', oidcIssuerUrl: 'https://example.com', clientId: 'client-id', tokenExpiryFromAuthInSeconds: 300, tokenExpireFromIssueInSeconds: 600, }, },});In your application, you can perform CRUD operations against the model with the oidc auth mode.
try { final todo = Todo(content: 'My new todo'); final request = ModelMutations.create( todo, authorizationMode: APIAuthorizationType.oidc, ); final createdTodo = await Amplify.API.mutations(request: request).response;
if (createdTodo == null) { safePrint('errors: ${response.errors}'); return; } safePrint('Mutation result: ${createdTodo.name}');
} on APIException catch (e) { safePrint('Failed to create todo', e);}