Tenant administrators can connect an Amazon Cognito user pool to a WoodsPortal implementation so eligible portal users can sign in through the organization's configured identity experience.

Before you begin

  • Use an AWS account with permission to configure Amazon Cognito in the selected AWS Region.
  • Use WoodsPortal administrator access to the Integration Manager in https://app.woodsportal.com.
  • Prepare a safe test user whose email address matches the intended portal user.
  • Copy the exact callback URL shown by WoodsPortal. Do not construct or shorten it manually.

Create or prepare the Cognito user pool

  • In AWS, open Amazon Cognito and select the Region that will host the user pool.
  • Create a user pool or open the pool intended for WoodsPortal users.
  • Configure email as a sign-in or required identity attribute when that matches the portal's identity policy.
  • Configure the pool's verification, password, and multi-factor policies according to your organization's security requirements.
  • Create a Cognito hosted UI domain for the user pool and record the exact domain and Region.

Create the app client

  • Create a confidential app client that generates a client secret.
  • Enable the authorization code grant for the hosted UI.
  • Add the exact WoodsPortal callback URL shown in the Integration Manager.
  • Add an approved sign-out URL if your implementation requires one.
  • Enable the OpenID Connect scopes openid, email, and profile.
  • Save the client ID and client secret in an approved password or secrets manager.

Connect Cognito to WoodsPortal

  • In https://app.woodsportal.com, select the intended portal and open the Integration Manager.
  • Open the AWS Cognito or OpenID Connect configuration available for that portal.
  • Enter the selected AWS Region, Cognito hosted UI or issuer information, client ID, and client secret exactly as requested.
  • Confirm that the callback URL in AWS exactly matches the value shown by WoodsPortal.
  • Save the connection and use the available test or sign-in flow with the safe test user.

Test the portal-user experience

  • Open the customer portal URL supplied by your organization and enter the test user's email address.
  • Choose the configured single sign-on method when it appears.
  • Complete the Cognito hosted sign-in flow.
  • Confirm that the user returns to the intended customer portal and can access only the permitted records and resources.

Troubleshooting

  • If Cognito reports a callback mismatch, compare the full callback URLs character by character, including protocol, path, and trailing slash.
  • If the sign-in option is missing, confirm that the connection is enabled for the intended portal and user.
  • If authentication succeeds but portal access fails, verify the HubSpot contact, Woods Portal Access value, Primary Company relationship where used, invitation state, and assigned portal role.
  • If tokens are rejected, confirm the Region, hosted UI domain or issuer, app client ID, client secret, and enabled openid, email, and profile scopes.
  • Rotate an exposed client secret in AWS and update the stored WoodsPortal connection before testing again.

[Visual placeholder: Cognito user pool, app client, and WoodsPortal Integration Manager | Use a safe test user and redacted client secret | Configure the hosted UI, callback URL, and OIDC scopes, then test sign-in | The user returns to the intended customer portal.]