OAuth2 operations are performed against the following OAuth2 endpoints using the "profile" scope:
- Authorization: https://www.amazon.com/ap/oa
- Token Retrieval: https://api.amazon.com/auth/o2/token
- User details acquisition: https://api.amazon.com/user/profile
A client specific "Login with Amazon" Security Profile must be created in order to access Login with Amazon services as well as user profile data.
Parameters
As well as the parameters described in Base Provider Parameters, the following must be set in the params object.
| Name | Type | Description |
|---|---|---|
| client_id | String, required | The Client ID provided by Amazon |
| client_secret | String, required | The Client Secret key provided by Amazon |
User Profile Data
Requested scope: profile.
We request the following information from Amazon about a user. The properties are automatically mapped to the Authentication Worker's UserProfile class. These properties are then mapped to actual fields in a site user's profile, following the mappings set up in the
| Amazon Property | Mapped To | Description |
|---|---|---|
| user_id | UNIQUEID | Amazon's unique user identifier |
| NAME | FORENAMES | The full name of the user |
| name | PREFERREDNAME | The user's preferred name |
| The user's email address |
See the Linking Providers, Account and Profile Management article for information about how profiles and email addresses are updated.
Configuration Example
{
"providerName": "amazon",
"providerDisplayName": "Amazon",
"type": "amazon",
"userPrefix": "AM_",
"params": {
"client_id": "amzn1.application-oa2-client.000000000000000",
"client_secret": "abcdef1234567890",
"checkConsentToStoreData": true,
"failIfConsentNotGiven": true
}
}
Setup
Amazon's documentation can be found at https://login.amazon.com/documentation (opens new window).
Log into Amazon using the developer account that will control your "Login with Amazon". The current URL is https://developer.amazon.com/lwa/sp/overview.html
Create an new Amazon Security Profile. In the web settings configuration add the authentication worker's return URL (eg https://mywebsite.com/apiserver/auth/http/reentry) as an "allowed return URL". This URL must use https.
You'll find the Client ID and Client Secret keys in the "General" section of the security profile. Add these to the provider configuration in iCM.
Share this page
