sample-native-login

A reference first-party sign-in page for Eclipse Dirigible's native login flow (eclipse-dirigible/dirigible#6828). On the cognito profile, the platform's POST /login/native endpoint authenticates the credentials server-side over Cognito's USER_SRP_AUTH flow and establishes the standard platform session — so the application owns the whole login UX and the provider-hosted page is never rendered. This project is that page, in ~100 lines of dependency-free HTML/JS.

What it demonstrates:

• Credential sign-in — the form posts {username, password} to /login/native; on AUTHENTICATED the session cookie is set and the page navigates to /.
• The challenge round-trip — when the provider requires more (SOFTWARE_TOKEN_MFA, SMS_MFA, EMAIL_OTP, NEW_PASSWORD_REQUIRED, CUSTOM_CHALLENGE), the endpoint answers {outcome: "CHALLENGE", challenge, session, parameters} and the page switches to a second form that answers via /login/native/challenge.
• Normalized outcomes — failures carry outcome codes (INVALID_CREDENTIALS, PASSWORD_RESET_REQUIRED, USER_NOT_CONFIRMED, CODE_MISMATCH, CODE_EXPIRED, INVALID_PASSWORD, TOO_MANY_ATTEMPTS, ...), never provider-raw messages — the page maps them to its own texts, which is also where i18n would go.
• Federated SSO deep link — an optional link to /oauth2/authorization/cognito?identity_provider=<YourIdP> sends federated users straight to the corporate IdP through the allowlisted hint passthrough. Set SSO_IDENTITY_PROVIDER at the top of the script in index.html to the name of a federated identity provider registered in your user pool; it is empty (link hidden) by default.

Setup

1. Run Dirigible with the cognito profile (DIRIGIBLE_COGNITO_* variables configured).

2. Clone this repository through the IDE's Git perspective and Publish the project.

3. Point the platform at the page and restart:

   DIRIGIBLE_SECURITY_LOGIN_PAGE=/public/web/sample-native-login/index.html
   

Unauthenticated browser requests now land on this page instead of the provider-hosted one.

The three artefacts a public login page needs

A page under /public/web/** is only served anonymously when the project declares it, twice:

File	Purpose
index.html	the page itself
project.json	exposes — the web engine refuses non-exposed project content
security/*.access	an HTTP constraint with role Public — without it the security filter answers 403 for anonymous requests even under /public

Provider-side prerequisites

• The app client must allow the SRP flow (ALLOW_USER_SRP_AUTH) — it is enabled by default on new Cognito app clients.
• The native credential flow itself needs no registered callback URLs — tokens never leave the server. But the two hosted-flow touchpoints still do: the SSO deep link completes through the standard authorization-code callback, so the instance's ${DIRIGIBLE_HOST}/login/oauth2/code/cognito must be a registered callback URL, and logout hands off to Cognito's /logout with logout_uri=${DIRIGIBLE_HOST}, which must be a registered sign-out URL. Accessing the instance from an origin that is not registered (e.g. a LAN IP while only localhost is registered) shows Cognito's error page on exactly those two paths — add the origin to the app client, or align DIRIGIBLE_HOST with a registered one.