title: AWS cognito user pool server side flow with spring boot
body: <p>I want to implement AWS Cognito server side flow with spring boot. I don't quite understand what the flow should be. Should I use spring oauth along with it ?</p>
  
  <p>Requirement is something like this.
  As an admin create user and give access to these created users to use my API from API Gateway (Let's ignore API Gateway part and say we just need access token from cognito for now)</p>
  
  <p>Here is what I think should happen if I use AWS cognito with spring oauth2</p>
  
  <p>user hits <code>localhost:8000/oauth/token</code> - with basic authentication (username and password)
  which will do an API call with user credentials. User receives the token and uses it however he/she needs it.</p>
  
  <ol>
  <li>Is this flow secure ? Should I use spring oauth along ?</li>
  <li>How to handle <code>respond to auth challenge</code> ? Should user pass new password for first time when calling my application API ?</li>
  </ol>
  
  <pre><code>@RestController
  public class Oauth {
  
  
      @PostMapping(path = "/oauth/token")
      public AdminInitiateAuthResult token(@RequestHeader("username") String username, @RequestHeader("password") String password) {
  
          AWSCognitoIdentityProvider provider = AWSCognitoIdentityProviderClientBuilder
                  .standard()
                  .withRegion(Regions.US_WEST_2)
                  .withCredentials(new AWSStaticCredentialsProvider()).build();
  
  
          Map&lt;String, String&gt; authParams = new HashMap&lt;&gt;();
  
          authParams.put("USERNAME", username);
          authParams.put("PASSWORD", password);
  
          AdminInitiateAuthRequest adminInitiateAuthRequest = new AdminInitiateAuthRequest()
                  .withClientId("{client-id}")
                  .withUserPoolId("{user-pool-id}")
                  .withAuthFlow(AuthFlowType.ADMIN_USER_PASSWORD_AUTH)
                  .withAuthParameters(authParams);
  
          AdminInitiateAuthResult authResult = provider.adminInitiateAuth(adminInitiateAuthRequest);
          return authResult.getAuthenticationResult().getIdToken();
      }
  
  }
  </code></pre>