[{"data":1,"prerenderedAt":3125},["Reactive",2],{"article-wiring-entra-id-into-aws-cognito":3,"content-query-mXiNGv7cVg":1715,"navbar-has-work":6},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"published":10,"slug":11,"body":12,"_type":1709,"_id":1710,"_source":1711,"_file":1712,"_stem":1713,"_extension":1714},"/articles/wiring-entra-id-into-aws-cognito","articles",false,"","How I Made Microsoft Entra ID Groups Behave Like Cognito Groups","A small Terraform setup that federates Entra ID into Cognito and rewrites cognito:groups via a pre-token-generation Lambda, so your apps can authorise on real Entra group IDs.","2026/5/27","wiring-entra-id-into-aws-cognito",{"type":13,"children":14,"toc":1696},"root",[15,31,36,47,59,66,95,100,115,132,138,147,152,213,218,391,396,402,407,414,419,669,683,710,729,942,947,953,972,1070,1075,1081,1093,1101,1112,1339,1344,1557,1569,1575,1580,1585,1655,1667,1673,1685,1690],{"type":16,"tag":17,"props":18,"children":19},"element","p",{},[20,23,29],{"type":21,"value":22},"text","Every now and then a piece of integration work shows up that ",{"type":16,"tag":24,"props":25,"children":26},"em",{},[27],{"type":21,"value":28},"looks",{"type":21,"value":30}," simple from a one-paragraph summary and then quietly eats half a sprint. Federating Microsoft Entra ID into AWS Cognito is one of those.",{"type":16,"tag":17,"props":32,"children":33},{},[34],{"type":21,"value":35},"The first 80% is well-trodden. There are docs and blog posts everywhere about wiring Cognito's SAML support up to an Entra app registration. SSO works, users sign in with their Microsoft account, the access token shows up on your API, everyone is happy.",{"type":16,"tag":17,"props":37,"children":38},{},[39,41],{"type":21,"value":40},"The last 20% is the bit that quietly surprises people: ",{"type":16,"tag":42,"props":43,"children":44},"strong",{},[45],{"type":21,"value":46},"the groups your authorisation actually depends on do not turn up where you expect them.",{"type":16,"tag":17,"props":48,"children":49},{},[50,52,57],{"type":21,"value":51},"This is a write-up of how I solved that, in Terraform, on a project where the application needed to do RBAC against Entra groups without ever touching Microsoft Graph at runtime. The snippets below are the ",{"type":16,"tag":24,"props":53,"children":54},{},[55],{"type":21,"value":56},"minimal honest version",{"type":21,"value":58}," of the pattern, not a production-hardened module 🙂",{"type":16,"tag":60,"props":61,"children":63},"h2",{"id":62},"the-problem-in-plain-english",[64],{"type":21,"value":65},"The problem in plain English",{"type":16,"tag":17,"props":67,"children":68},{},[69,71,78,80,86,88,93],{"type":21,"value":70},"When you federate Cognito with Entra over SAML and Entra's SAML assertion includes a ",{"type":16,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":21,"value":77},"groups",{"type":21,"value":79}," claim, Cognito does receive the groups. They just do not end up on ",{"type":16,"tag":72,"props":81,"children":83},{"className":82},[],[84],{"type":21,"value":85},"cognito:groups",{"type":21,"value":87},", because that claim is reserved for the ",{"type":16,"tag":24,"props":89,"children":90},{},[91],{"type":21,"value":92},"native",{"type":21,"value":94}," Cognito user-pool group concept.",{"type":16,"tag":17,"props":96,"children":97},{},[98],{"type":21,"value":99},"Out of the box you have two unhappy options:",{"type":16,"tag":101,"props":102,"children":103},"ul",{},[104,110],{"type":16,"tag":105,"props":106,"children":107},"li",{},[108],{"type":21,"value":109},"Read the groups from a non-standard claim everywhere your application authorises, which means every consumer of the token has to learn about your specific federation choice",{"type":16,"tag":105,"props":111,"children":112},{},[113],{"type":21,"value":114},"Have the app call Microsoft Graph on every request to fetch group memberships, which is a latency, blast-radius and cost decision you probably do not want to be making",{"type":16,"tag":17,"props":116,"children":117},{},[118,120],{"type":21,"value":119},"What I wanted was the third option: ",{"type":16,"tag":42,"props":121,"children":122},{},[123,125,130],{"type":21,"value":124},"the access token already has ",{"type":16,"tag":72,"props":126,"children":128},{"className":127},[],[129],{"type":21,"value":85},{"type":21,"value":131}," populated with the user's Entra group IDs, and downstream APIs authorise on it like any other Cognito token.",{"type":16,"tag":60,"props":133,"children":135},{"id":134},"the-shape-of-the-solution",[136],{"type":21,"value":137},"The shape of the solution",{"type":16,"tag":139,"props":140,"children":142},"pre",{"code":141}," Entra ID ──SAML──► Cognito User Pool ──pre-token Lambda──► JWT\n (groups claim) (custom:entra_groups) (cognito:groups)\n",[143],{"type":16,"tag":72,"props":144,"children":145},{"__ignoreMap":7},[146],{"type":21,"value":141},{"type":16,"tag":17,"props":148,"children":149},{},[150],{"type":21,"value":151},"Three moving parts:",{"type":16,"tag":153,"props":154,"children":155},"ol",{},[156,176,208],{"type":16,"tag":105,"props":157,"children":158},{},[159,161,166,168,174],{"type":21,"value":160},"A ",{"type":16,"tag":42,"props":162,"children":163},{},[164],{"type":21,"value":165},"custom user-pool attribute",{"type":21,"value":167}," (",{"type":16,"tag":72,"props":169,"children":171},{"className":170},[],[172],{"type":21,"value":173},"custom:entra_groups",{"type":21,"value":175},") that the SAML attribute mapping writes the raw groups list into on sign-in",{"type":16,"tag":105,"props":177,"children":178},{},[179,180,185,187,192,194,199,201,206],{"type":21,"value":160},{"type":16,"tag":42,"props":181,"children":182},{},[183],{"type":21,"value":184},"pre-token-generation Lambda",{"type":21,"value":186}," (V2_0 trigger) that reads ",{"type":16,"tag":72,"props":188,"children":190},{"className":189},[],[191],{"type":21,"value":173},{"type":21,"value":193}," at token-issuance time and rewrites ",{"type":16,"tag":72,"props":195,"children":197},{"className":196},[],[198],{"type":21,"value":85},{"type":21,"value":200}," on ",{"type":16,"tag":42,"props":202,"children":203},{},[204],{"type":21,"value":205},"both",{"type":21,"value":207}," the ID and access tokens",{"type":16,"tag":105,"props":209,"children":210},{},[211],{"type":21,"value":212},"A Terraform module that wires those together without leaking the awkward parts into the consuming stack",{"type":16,"tag":17,"props":214,"children":215},{},[216],{"type":21,"value":217},"Calling the module ends up looking like this:",{"type":16,"tag":139,"props":219,"children":223},{"code":220,"language":221,"meta":7,"className":222,"style":7},"module \"auth\" {\n source = \"./modules/cognito-entra-federation\"\n\n name_prefix = \"demo-app\"\n saml_metadata_url = \"https://login.microsoftonline.com/\u003CTENANT>/federationmetadata/2007-06/federationmetadata.xml?appid=\u003CAPP>\"\n\n app_callback_urls = [\"https://app.example.com/auth/callback\"]\n app_logout_urls = [\"https://app.example.com/logout\"]\n}\n","hcl","language-hcl shiki shiki-themes github-light github-dark",[224],{"type":16,"tag":72,"props":225,"children":226},{"__ignoreMap":7},[227,251,272,282,301,319,327,355,382],{"type":16,"tag":228,"props":229,"children":232},"span",{"class":230,"line":231},"line",1,[233,239,245],{"type":16,"tag":228,"props":234,"children":236},{"style":235},"--shiki-default:#6F42C1;--shiki-dark:#B392F0",[237],{"type":21,"value":238},"module",{"type":16,"tag":228,"props":240,"children":242},{"style":241},"--shiki-default:#005CC5;--shiki-dark:#79B8FF",[243],{"type":21,"value":244}," \"auth\"",{"type":16,"tag":228,"props":246,"children":248},{"style":247},"--shiki-default:#24292E;--shiki-dark:#E1E4E8",[249],{"type":21,"value":250}," {\n",{"type":16,"tag":228,"props":252,"children":254},{"class":230,"line":253},2,[255,260,266],{"type":16,"tag":228,"props":256,"children":257},{"style":247},[258],{"type":21,"value":259}," source",{"type":16,"tag":228,"props":261,"children":263},{"style":262},"--shiki-default:#D73A49;--shiki-dark:#F97583",[264],{"type":21,"value":265}," =",{"type":16,"tag":228,"props":267,"children":269},{"style":268},"--shiki-default:#032F62;--shiki-dark:#9ECBFF",[270],{"type":21,"value":271}," \"./modules/cognito-entra-federation\"\n",{"type":16,"tag":228,"props":273,"children":275},{"class":230,"line":274},3,[276],{"type":16,"tag":228,"props":277,"children":279},{"emptyLinePlaceholder":278},true,[280],{"type":21,"value":281},"\n",{"type":16,"tag":228,"props":283,"children":285},{"class":230,"line":284},4,[286,291,296],{"type":16,"tag":228,"props":287,"children":288},{"style":247},[289],{"type":21,"value":290}," name_prefix",{"type":16,"tag":228,"props":292,"children":293},{"style":262},[294],{"type":21,"value":295}," =",{"type":16,"tag":228,"props":297,"children":298},{"style":268},[299],{"type":21,"value":300}," \"demo-app\"\n",{"type":16,"tag":228,"props":302,"children":304},{"class":230,"line":303},5,[305,310,314],{"type":16,"tag":228,"props":306,"children":307},{"style":247},[308],{"type":21,"value":309}," saml_metadata_url",{"type":16,"tag":228,"props":311,"children":312},{"style":262},[313],{"type":21,"value":265},{"type":16,"tag":228,"props":315,"children":316},{"style":268},[317],{"type":21,"value":318}," \"https://login.microsoftonline.com/\u003CTENANT>/federationmetadata/2007-06/federationmetadata.xml?appid=\u003CAPP>\"\n",{"type":16,"tag":228,"props":320,"children":322},{"class":230,"line":321},6,[323],{"type":16,"tag":228,"props":324,"children":325},{"emptyLinePlaceholder":278},[326],{"type":21,"value":281},{"type":16,"tag":228,"props":328,"children":330},{"class":230,"line":329},7,[331,336,340,345,350],{"type":16,"tag":228,"props":332,"children":333},{"style":247},[334],{"type":21,"value":335}," app_callback_urls",{"type":16,"tag":228,"props":337,"children":338},{"style":262},[339],{"type":21,"value":265},{"type":16,"tag":228,"props":341,"children":342},{"style":247},[343],{"type":21,"value":344}," [",{"type":16,"tag":228,"props":346,"children":347},{"style":268},[348],{"type":21,"value":349},"\"https://app.example.com/auth/callback\"",{"type":16,"tag":228,"props":351,"children":352},{"style":247},[353],{"type":21,"value":354},"]\n",{"type":16,"tag":228,"props":356,"children":358},{"class":230,"line":357},8,[359,364,369,373,378],{"type":16,"tag":228,"props":360,"children":361},{"style":247},[362],{"type":21,"value":363}," app_logout_urls",{"type":16,"tag":228,"props":365,"children":366},{"style":262},[367],{"type":21,"value":368}," =",{"type":16,"tag":228,"props":370,"children":371},{"style":247},[372],{"type":21,"value":344},{"type":16,"tag":228,"props":374,"children":375},{"style":268},[376],{"type":21,"value":377},"\"https://app.example.com/logout\"",{"type":16,"tag":228,"props":379,"children":380},{"style":247},[381],{"type":21,"value":354},{"type":16,"tag":228,"props":383,"children":385},{"class":230,"line":384},9,[386],{"type":16,"tag":228,"props":387,"children":388},{"style":247},[389],{"type":21,"value":390},"}\n",{"type":16,"tag":17,"props":392,"children":393},{},[394],{"type":21,"value":395},"That is roughly all the consuming stack needs to know.",{"type":16,"tag":60,"props":397,"children":399},{"id":398},"the-fun-bits",[400],{"type":21,"value":401},"The fun bits",{"type":16,"tag":17,"props":403,"children":404},{},[405],{"type":21,"value":406},"This is the section I enjoyed writing most, because every step here is a small gotcha that is obvious in retrospect and quietly painful the first time.",{"type":16,"tag":408,"props":409,"children":411},"h3",{"id":410},"_1-the-user-pool-schema-is-immutable-once-written",[412],{"type":21,"value":413},"1. The user-pool schema is immutable once written",{"type":16,"tag":17,"props":415,"children":416},{},[417],{"type":21,"value":418},"Cognito will not let you change a schema attribute after the pool exists. If Terraform tries to \"fix\" the schema on a later apply it will plan a destructive replacement of the entire pool, which is rarely what anyone wants on a Tuesday afternoon. The simplest defence is to tell Terraform to stop looking:",{"type":16,"tag":139,"props":420,"children":422},{"code":421,"language":221,"meta":7,"className":222,"style":7},"resource \"aws_cognito_user_pool\" \"this\" {\n name = \"${var.name_prefix}-users\"\n\n lifecycle {\n ignore_changes = [schema]\n }\n\n schema {\n name = \"entra_groups\"\n attribute_data_type = \"String\"\n mutable = true\n string_attribute_constraints {\n max_length = \"4096\"\n }\n }\n}\n",[423],{"type":16,"tag":72,"props":424,"children":425},{"__ignoreMap":7},[426,448,495,502,514,531,539,546,558,576,594,613,626,644,653,661],{"type":16,"tag":228,"props":427,"children":428},{"class":230,"line":231},[429,434,439,444],{"type":16,"tag":228,"props":430,"children":431},{"style":235},[432],{"type":21,"value":433},"resource",{"type":16,"tag":228,"props":435,"children":436},{"style":241},[437],{"type":21,"value":438}," \"aws_cognito_user_pool\"",{"type":16,"tag":228,"props":440,"children":441},{"style":241},[442],{"type":21,"value":443}," \"this\"",{"type":16,"tag":228,"props":445,"children":446},{"style":247},[447],{"type":21,"value":250},{"type":16,"tag":228,"props":449,"children":450},{"class":230,"line":253},[451,456,460,465,470,475,480,485,490],{"type":16,"tag":228,"props":452,"children":453},{"style":247},[454],{"type":21,"value":455}," name",{"type":16,"tag":228,"props":457,"children":458},{"style":262},[459],{"type":21,"value":265},{"type":16,"tag":228,"props":461,"children":462},{"style":268},[463],{"type":21,"value":464}," \"",{"type":16,"tag":228,"props":466,"children":467},{"style":262},[468],{"type":21,"value":469},"${",{"type":16,"tag":228,"props":471,"children":472},{"style":247},[473],{"type":21,"value":474},"var",{"type":16,"tag":228,"props":476,"children":477},{"style":262},[478],{"type":21,"value":479},".",{"type":16,"tag":228,"props":481,"children":482},{"style":247},[483],{"type":21,"value":484},"name_prefix",{"type":16,"tag":228,"props":486,"children":487},{"style":262},[488],{"type":21,"value":489},"}",{"type":16,"tag":228,"props":491,"children":492},{"style":268},[493],{"type":21,"value":494},"-users\"\n",{"type":16,"tag":228,"props":496,"children":497},{"class":230,"line":274},[498],{"type":16,"tag":228,"props":499,"children":500},{"emptyLinePlaceholder":278},[501],{"type":21,"value":281},{"type":16,"tag":228,"props":503,"children":504},{"class":230,"line":284},[505,510],{"type":16,"tag":228,"props":506,"children":507},{"style":235},[508],{"type":21,"value":509}," lifecycle",{"type":16,"tag":228,"props":511,"children":512},{"style":247},[513],{"type":21,"value":250},{"type":16,"tag":228,"props":515,"children":516},{"class":230,"line":303},[517,522,526],{"type":16,"tag":228,"props":518,"children":519},{"style":247},[520],{"type":21,"value":521}," ignore_changes",{"type":16,"tag":228,"props":523,"children":524},{"style":262},[525],{"type":21,"value":265},{"type":16,"tag":228,"props":527,"children":528},{"style":247},[529],{"type":21,"value":530}," [schema]\n",{"type":16,"tag":228,"props":532,"children":533},{"class":230,"line":321},[534],{"type":16,"tag":228,"props":535,"children":536},{"style":247},[537],{"type":21,"value":538}," }\n",{"type":16,"tag":228,"props":540,"children":541},{"class":230,"line":329},[542],{"type":16,"tag":228,"props":543,"children":544},{"emptyLinePlaceholder":278},[545],{"type":21,"value":281},{"type":16,"tag":228,"props":547,"children":548},{"class":230,"line":357},[549,554],{"type":16,"tag":228,"props":550,"children":551},{"style":235},[552],{"type":21,"value":553}," schema",{"type":16,"tag":228,"props":555,"children":556},{"style":247},[557],{"type":21,"value":250},{"type":16,"tag":228,"props":559,"children":560},{"class":230,"line":384},[561,566,571],{"type":16,"tag":228,"props":562,"children":563},{"style":247},[564],{"type":21,"value":565}," name",{"type":16,"tag":228,"props":567,"children":568},{"style":262},[569],{"type":21,"value":570}," =",{"type":16,"tag":228,"props":572,"children":573},{"style":268},[574],{"type":21,"value":575}," \"entra_groups\"\n",{"type":16,"tag":228,"props":577,"children":579},{"class":230,"line":578},10,[580,585,589],{"type":16,"tag":228,"props":581,"children":582},{"style":247},[583],{"type":21,"value":584}," attribute_data_type",{"type":16,"tag":228,"props":586,"children":587},{"style":262},[588],{"type":21,"value":265},{"type":16,"tag":228,"props":590,"children":591},{"style":268},[592],{"type":21,"value":593}," \"String\"\n",{"type":16,"tag":228,"props":595,"children":597},{"class":230,"line":596},11,[598,603,608],{"type":16,"tag":228,"props":599,"children":600},{"style":247},[601],{"type":21,"value":602}," mutable",{"type":16,"tag":228,"props":604,"children":605},{"style":262},[606],{"type":21,"value":607}," =",{"type":16,"tag":228,"props":609,"children":610},{"style":241},[611],{"type":21,"value":612}," true\n",{"type":16,"tag":228,"props":614,"children":616},{"class":230,"line":615},12,[617,622],{"type":16,"tag":228,"props":618,"children":619},{"style":235},[620],{"type":21,"value":621}," string_attribute_constraints",{"type":16,"tag":228,"props":623,"children":624},{"style":247},[625],{"type":21,"value":250},{"type":16,"tag":228,"props":627,"children":629},{"class":230,"line":628},13,[630,635,639],{"type":16,"tag":228,"props":631,"children":632},{"style":247},[633],{"type":21,"value":634}," max_length",{"type":16,"tag":228,"props":636,"children":637},{"style":262},[638],{"type":21,"value":265},{"type":16,"tag":228,"props":640,"children":641},{"style":268},[642],{"type":21,"value":643}," \"4096\"\n",{"type":16,"tag":228,"props":645,"children":647},{"class":230,"line":646},14,[648],{"type":16,"tag":228,"props":649,"children":650},{"style":247},[651],{"type":21,"value":652}," }\n",{"type":16,"tag":228,"props":654,"children":656},{"class":230,"line":655},15,[657],{"type":16,"tag":228,"props":658,"children":659},{"style":247},[660],{"type":21,"value":538},{"type":16,"tag":228,"props":662,"children":664},{"class":230,"line":663},16,[665],{"type":16,"tag":228,"props":666,"children":667},{"style":247},[668],{"type":21,"value":390},{"type":16,"tag":408,"props":670,"children":672},{"id":671},"_2-metadataurl-populates-other-fields-you-must-also-ignore",[673,675,681],{"type":21,"value":674},"2. ",{"type":16,"tag":72,"props":676,"children":678},{"className":677},[],[679],{"type":21,"value":680},"MetadataURL",{"type":21,"value":682}," populates other fields you must also ignore",{"type":16,"tag":17,"props":684,"children":685},{},[686,688,693,695,700,702,708],{"type":21,"value":687},"When the SAML IdP is created with a ",{"type":16,"tag":72,"props":689,"children":691},{"className":690},[],[692],{"type":21,"value":680},{"type":21,"value":694},", AWS fetches the XML in the background and stores the signing certificate, single-logout bindings and friends into the ",{"type":16,"tag":24,"props":696,"children":697},{},[698],{"type":21,"value":699},"same",{"type":21,"value":701}," ",{"type":16,"tag":72,"props":703,"children":705},{"className":704},[],[706],{"type":21,"value":707},"provider_details",{"type":21,"value":709}," map. On the next plan, Terraform sees those AWS-populated fields as drift and tries to remove them, which quietly breaks the IdP.",{"type":16,"tag":17,"props":711,"children":712},{},[713,715,720,722,727],{"type":21,"value":714},"The fix is to ignore changes to ",{"type":16,"tag":72,"props":716,"children":718},{"className":717},[],[719],{"type":21,"value":707},{"type":21,"value":721},", ",{"type":16,"tag":42,"props":723,"children":724},{},[725],{"type":21,"value":726},"and",{"type":21,"value":728}," make a deliberate change to the metadata URL still force a replacement:",{"type":16,"tag":139,"props":730,"children":732},{"code":731,"language":221,"meta":7,"className":222,"style":7},"resource \"terraform_data\" \"metadata_url_pin\" {\n input = var.saml_metadata_url\n}\n\nresource \"aws_cognito_identity_provider\" \"entra\" {\n provider_details = {\n MetadataURL = var.saml_metadata_url\n }\n\n lifecycle {\n ignore_changes = [provider_details]\n replace_triggered_by = [terraform_data.metadata_url_pin.output]\n }\n}\n",[733],{"type":16,"tag":72,"props":734,"children":735},{"__ignoreMap":7},[736,757,783,790,797,818,834,852,859,866,877,893,928,935],{"type":16,"tag":228,"props":737,"children":738},{"class":230,"line":231},[739,743,748,753],{"type":16,"tag":228,"props":740,"children":741},{"style":235},[742],{"type":21,"value":433},{"type":16,"tag":228,"props":744,"children":745},{"style":241},[746],{"type":21,"value":747}," \"terraform_data\"",{"type":16,"tag":228,"props":749,"children":750},{"style":241},[751],{"type":21,"value":752}," \"metadata_url_pin\"",{"type":16,"tag":228,"props":754,"children":755},{"style":247},[756],{"type":21,"value":250},{"type":16,"tag":228,"props":758,"children":759},{"class":230,"line":253},[760,765,769,774,778],{"type":16,"tag":228,"props":761,"children":762},{"style":247},[763],{"type":21,"value":764}," input",{"type":16,"tag":228,"props":766,"children":767},{"style":262},[768],{"type":21,"value":265},{"type":16,"tag":228,"props":770,"children":771},{"style":247},[772],{"type":21,"value":773}," var",{"type":16,"tag":228,"props":775,"children":776},{"style":262},[777],{"type":21,"value":479},{"type":16,"tag":228,"props":779,"children":780},{"style":247},[781],{"type":21,"value":782},"saml_metadata_url\n",{"type":16,"tag":228,"props":784,"children":785},{"class":230,"line":274},[786],{"type":16,"tag":228,"props":787,"children":788},{"style":247},[789],{"type":21,"value":390},{"type":16,"tag":228,"props":791,"children":792},{"class":230,"line":284},[793],{"type":16,"tag":228,"props":794,"children":795},{"emptyLinePlaceholder":278},[796],{"type":21,"value":281},{"type":16,"tag":228,"props":798,"children":799},{"class":230,"line":303},[800,804,809,814],{"type":16,"tag":228,"props":801,"children":802},{"style":235},[803],{"type":21,"value":433},{"type":16,"tag":228,"props":805,"children":806},{"style":241},[807],{"type":21,"value":808}," \"aws_cognito_identity_provider\"",{"type":16,"tag":228,"props":810,"children":811},{"style":241},[812],{"type":21,"value":813}," \"entra\"",{"type":16,"tag":228,"props":815,"children":816},{"style":247},[817],{"type":21,"value":250},{"type":16,"tag":228,"props":819,"children":820},{"class":230,"line":321},[821,826,830],{"type":16,"tag":228,"props":822,"children":823},{"style":247},[824],{"type":21,"value":825}," provider_details",{"type":16,"tag":228,"props":827,"children":828},{"style":262},[829],{"type":21,"value":265},{"type":16,"tag":228,"props":831,"children":832},{"style":247},[833],{"type":21,"value":250},{"type":16,"tag":228,"props":835,"children":836},{"class":230,"line":329},[837,842,847],{"type":16,"tag":228,"props":838,"children":839},{"style":247},[840],{"type":21,"value":841}," MetadataURL ",{"type":16,"tag":228,"props":843,"children":844},{"style":262},[845],{"type":21,"value":846},"=",{"type":16,"tag":228,"props":848,"children":849},{"style":247},[850],{"type":21,"value":851}," var.saml_metadata_url\n",{"type":16,"tag":228,"props":853,"children":854},{"class":230,"line":357},[855],{"type":16,"tag":228,"props":856,"children":857},{"style":247},[858],{"type":21,"value":538},{"type":16,"tag":228,"props":860,"children":861},{"class":230,"line":384},[862],{"type":16,"tag":228,"props":863,"children":864},{"emptyLinePlaceholder":278},[865],{"type":21,"value":281},{"type":16,"tag":228,"props":867,"children":868},{"class":230,"line":578},[869,873],{"type":16,"tag":228,"props":870,"children":871},{"style":235},[872],{"type":21,"value":509},{"type":16,"tag":228,"props":874,"children":875},{"style":247},[876],{"type":21,"value":250},{"type":16,"tag":228,"props":878,"children":879},{"class":230,"line":596},[880,884,888],{"type":16,"tag":228,"props":881,"children":882},{"style":247},[883],{"type":21,"value":521},{"type":16,"tag":228,"props":885,"children":886},{"style":262},[887],{"type":21,"value":295},{"type":16,"tag":228,"props":889,"children":890},{"style":247},[891],{"type":21,"value":892}," [provider_details]\n",{"type":16,"tag":228,"props":894,"children":895},{"class":230,"line":615},[896,901,905,910,914,919,923],{"type":16,"tag":228,"props":897,"children":898},{"style":247},[899],{"type":21,"value":900}," replace_triggered_by",{"type":16,"tag":228,"props":902,"children":903},{"style":262},[904],{"type":21,"value":265},{"type":16,"tag":228,"props":906,"children":907},{"style":247},[908],{"type":21,"value":909}," [terraform_data",{"type":16,"tag":228,"props":911,"children":912},{"style":262},[913],{"type":21,"value":479},{"type":16,"tag":228,"props":915,"children":916},{"style":247},[917],{"type":21,"value":918},"metadata_url_pin",{"type":16,"tag":228,"props":920,"children":921},{"style":262},[922],{"type":21,"value":479},{"type":16,"tag":228,"props":924,"children":925},{"style":247},[926],{"type":21,"value":927},"output]\n",{"type":16,"tag":228,"props":929,"children":930},{"class":230,"line":628},[931],{"type":16,"tag":228,"props":932,"children":933},{"style":247},[934],{"type":21,"value":538},{"type":16,"tag":228,"props":936,"children":937},{"class":230,"line":646},[938],{"type":16,"tag":228,"props":939,"children":940},{"style":247},[941],{"type":21,"value":390},{"type":16,"tag":17,"props":943,"children":944},{},[945],{"type":21,"value":946},"This combination took me longer to land on than I would like to admit.",{"type":16,"tag":408,"props":948,"children":950},{"id":949},"_3-the-v2_0-trigger-is-not-optional",[951],{"type":21,"value":952},"3. The V2_0 trigger is not optional",{"type":16,"tag":17,"props":954,"children":955},{},[956,958,963,965,970],{"type":21,"value":957},"The legacy V1_0 pre-token-generation event can only modify the ID token. To also rewrite ",{"type":16,"tag":72,"props":959,"children":961},{"className":960},[],[962],{"type":21,"value":85},{"type":21,"value":964}," on the ",{"type":16,"tag":42,"props":966,"children":967},{},[968],{"type":21,"value":969},"access token",{"type":21,"value":971},", the one your APIs almost always validate, you need V2_0:",{"type":16,"tag":139,"props":973,"children":975},{"code":974,"language":221,"meta":7,"className":222,"style":7},"lambda_config {\n pre_token_generation_config {\n lambda_arn = aws_lambda_function.pre_token.arn\n lambda_version = \"V2_0\"\n }\n}\n",[976],{"type":16,"tag":72,"props":977,"children":978},{"__ignoreMap":7},[979,991,1003,1039,1056,1063],{"type":16,"tag":228,"props":980,"children":981},{"class":230,"line":231},[982,987],{"type":16,"tag":228,"props":983,"children":984},{"style":235},[985],{"type":21,"value":986},"lambda_config",{"type":16,"tag":228,"props":988,"children":989},{"style":247},[990],{"type":21,"value":250},{"type":16,"tag":228,"props":992,"children":993},{"class":230,"line":253},[994,999],{"type":16,"tag":228,"props":995,"children":996},{"style":235},[997],{"type":21,"value":998}," pre_token_generation_config",{"type":16,"tag":228,"props":1000,"children":1001},{"style":247},[1002],{"type":21,"value":250},{"type":16,"tag":228,"props":1004,"children":1005},{"class":230,"line":274},[1006,1011,1016,1021,1025,1030,1034],{"type":16,"tag":228,"props":1007,"children":1008},{"style":247},[1009],{"type":21,"value":1010}," lambda_arn",{"type":16,"tag":228,"props":1012,"children":1013},{"style":262},[1014],{"type":21,"value":1015}," =",{"type":16,"tag":228,"props":1017,"children":1018},{"style":247},[1019],{"type":21,"value":1020}," aws_lambda_function",{"type":16,"tag":228,"props":1022,"children":1023},{"style":262},[1024],{"type":21,"value":479},{"type":16,"tag":228,"props":1026,"children":1027},{"style":247},[1028],{"type":21,"value":1029},"pre_token",{"type":16,"tag":228,"props":1031,"children":1032},{"style":262},[1033],{"type":21,"value":479},{"type":16,"tag":228,"props":1035,"children":1036},{"style":247},[1037],{"type":21,"value":1038},"arn\n",{"type":16,"tag":228,"props":1040,"children":1041},{"class":230,"line":284},[1042,1047,1051],{"type":16,"tag":228,"props":1043,"children":1044},{"style":247},[1045],{"type":21,"value":1046}," lambda_version",{"type":16,"tag":228,"props":1048,"children":1049},{"style":262},[1050],{"type":21,"value":265},{"type":16,"tag":228,"props":1052,"children":1053},{"style":268},[1054],{"type":21,"value":1055}," \"V2_0\"\n",{"type":16,"tag":228,"props":1057,"children":1058},{"class":230,"line":303},[1059],{"type":16,"tag":228,"props":1060,"children":1061},{"style":247},[1062],{"type":21,"value":538},{"type":16,"tag":228,"props":1064,"children":1065},{"class":230,"line":321},[1066],{"type":16,"tag":228,"props":1067,"children":1068},{"style":247},[1069],{"type":21,"value":390},{"type":16,"tag":17,"props":1071,"children":1072},{},[1073],{"type":21,"value":1074},"Forget this and you will spend an entertaining afternoon staring at a perfectly rewritten ID token while your API keeps rejecting the access token 😅",{"type":16,"tag":408,"props":1076,"children":1078},{"id":1077},"_4-entras-groups-claim-is-not-json",[1079],{"type":21,"value":1080},"4. Entra's groups claim is not JSON",{"type":16,"tag":17,"props":1082,"children":1083},{},[1084,1086,1091],{"type":21,"value":1085},"This one is my favourite. By the time the Entra group IDs land in ",{"type":16,"tag":72,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":21,"value":173},{"type":21,"value":1092},", the value looks deceptively like an array:",{"type":16,"tag":139,"props":1094,"children":1096},{"code":1095},"[a1b2c3-..., d4e5f6-..., 7g8h9i-...]\n",[1097],{"type":16,"tag":72,"props":1098,"children":1099},{"__ignoreMap":7},[1100],{"type":21,"value":1095},{"type":16,"tag":17,"props":1102,"children":1103},{},[1104,1110],{"type":16,"tag":72,"props":1105,"children":1107},{"className":1106},[],[1108],{"type":21,"value":1109},"json.loads",{"type":21,"value":1111}," will not parse it, because there are no quotes around the elements. So the Lambda does the only honest thing and strips the brackets and splits on commas:",{"type":16,"tag":139,"props":1113,"children":1117},{"code":1114,"language":1115,"meta":7,"className":1116,"style":7},"def _parse_groups(raw: str) -> list[str]:\n if not raw:\n return []\n text = raw.strip()\n if text.startswith(\"[\") and text.endswith(\"]\"):\n text = text[1:-1]\n return [item.strip() for item in text.split(\",\") if item.strip()]\n","python","language-python shiki shiki-themes github-light github-dark",[1118],{"type":16,"tag":72,"props":1119,"children":1120},{"__ignoreMap":7},[1121,1158,1176,1189,1206,1247,1287],{"type":16,"tag":228,"props":1122,"children":1123},{"class":230,"line":231},[1124,1129,1134,1139,1144,1149,1153],{"type":16,"tag":228,"props":1125,"children":1126},{"style":262},[1127],{"type":21,"value":1128},"def",{"type":16,"tag":228,"props":1130,"children":1131},{"style":235},[1132],{"type":21,"value":1133}," _parse_groups",{"type":16,"tag":228,"props":1135,"children":1136},{"style":247},[1137],{"type":21,"value":1138},"(raw: ",{"type":16,"tag":228,"props":1140,"children":1141},{"style":241},[1142],{"type":21,"value":1143},"str",{"type":16,"tag":228,"props":1145,"children":1146},{"style":247},[1147],{"type":21,"value":1148},") -> list[",{"type":16,"tag":228,"props":1150,"children":1151},{"style":241},[1152],{"type":21,"value":1143},{"type":16,"tag":228,"props":1154,"children":1155},{"style":247},[1156],{"type":21,"value":1157},"]:\n",{"type":16,"tag":228,"props":1159,"children":1160},{"class":230,"line":253},[1161,1166,1171],{"type":16,"tag":228,"props":1162,"children":1163},{"style":262},[1164],{"type":21,"value":1165}," if",{"type":16,"tag":228,"props":1167,"children":1168},{"style":262},[1169],{"type":21,"value":1170}," not",{"type":16,"tag":228,"props":1172,"children":1173},{"style":247},[1174],{"type":21,"value":1175}," raw:\n",{"type":16,"tag":228,"props":1177,"children":1178},{"class":230,"line":274},[1179,1184],{"type":16,"tag":228,"props":1180,"children":1181},{"style":262},[1182],{"type":21,"value":1183}," return",{"type":16,"tag":228,"props":1185,"children":1186},{"style":247},[1187],{"type":21,"value":1188}," []\n",{"type":16,"tag":228,"props":1190,"children":1191},{"class":230,"line":284},[1192,1197,1201],{"type":16,"tag":228,"props":1193,"children":1194},{"style":247},[1195],{"type":21,"value":1196}," text ",{"type":16,"tag":228,"props":1198,"children":1199},{"style":262},[1200],{"type":21,"value":846},{"type":16,"tag":228,"props":1202,"children":1203},{"style":247},[1204],{"type":21,"value":1205}," raw.strip()\n",{"type":16,"tag":228,"props":1207,"children":1208},{"class":230,"line":303},[1209,1213,1218,1223,1228,1232,1237,1242],{"type":16,"tag":228,"props":1210,"children":1211},{"style":262},[1212],{"type":21,"value":1165},{"type":16,"tag":228,"props":1214,"children":1215},{"style":247},[1216],{"type":21,"value":1217}," text.startswith(",{"type":16,"tag":228,"props":1219,"children":1220},{"style":268},[1221],{"type":21,"value":1222},"\"[\"",{"type":16,"tag":228,"props":1224,"children":1225},{"style":247},[1226],{"type":21,"value":1227},") ",{"type":16,"tag":228,"props":1229,"children":1230},{"style":262},[1231],{"type":21,"value":726},{"type":16,"tag":228,"props":1233,"children":1234},{"style":247},[1235],{"type":21,"value":1236}," text.endswith(",{"type":16,"tag":228,"props":1238,"children":1239},{"style":268},[1240],{"type":21,"value":1241},"\"]\"",{"type":16,"tag":228,"props":1243,"children":1244},{"style":247},[1245],{"type":21,"value":1246},"):\n",{"type":16,"tag":228,"props":1248,"children":1249},{"class":230,"line":321},[1250,1255,1259,1264,1269,1274,1279,1283],{"type":16,"tag":228,"props":1251,"children":1252},{"style":247},[1253],{"type":21,"value":1254}," text ",{"type":16,"tag":228,"props":1256,"children":1257},{"style":262},[1258],{"type":21,"value":846},{"type":16,"tag":228,"props":1260,"children":1261},{"style":247},[1262],{"type":21,"value":1263}," text[",{"type":16,"tag":228,"props":1265,"children":1266},{"style":241},[1267],{"type":21,"value":1268},"1",{"type":16,"tag":228,"props":1270,"children":1271},{"style":247},[1272],{"type":21,"value":1273},":",{"type":16,"tag":228,"props":1275,"children":1276},{"style":262},[1277],{"type":21,"value":1278},"-",{"type":16,"tag":228,"props":1280,"children":1281},{"style":241},[1282],{"type":21,"value":1268},{"type":16,"tag":228,"props":1284,"children":1285},{"style":247},[1286],{"type":21,"value":354},{"type":16,"tag":228,"props":1288,"children":1289},{"class":230,"line":329},[1290,1295,1300,1305,1310,1315,1320,1325,1329,1334],{"type":16,"tag":228,"props":1291,"children":1292},{"style":262},[1293],{"type":21,"value":1294}," return",{"type":16,"tag":228,"props":1296,"children":1297},{"style":247},[1298],{"type":21,"value":1299}," [item.strip() ",{"type":16,"tag":228,"props":1301,"children":1302},{"style":262},[1303],{"type":21,"value":1304},"for",{"type":16,"tag":228,"props":1306,"children":1307},{"style":247},[1308],{"type":21,"value":1309}," item ",{"type":16,"tag":228,"props":1311,"children":1312},{"style":262},[1313],{"type":21,"value":1314},"in",{"type":16,"tag":228,"props":1316,"children":1317},{"style":247},[1318],{"type":21,"value":1319}," text.split(",{"type":16,"tag":228,"props":1321,"children":1322},{"style":268},[1323],{"type":21,"value":1324},"\",\"",{"type":16,"tag":228,"props":1326,"children":1327},{"style":247},[1328],{"type":21,"value":1227},{"type":16,"tag":228,"props":1330,"children":1331},{"style":262},[1332],{"type":21,"value":1333},"if",{"type":16,"tag":228,"props":1335,"children":1336},{"style":247},[1337],{"type":21,"value":1338}," item.strip()]\n",{"type":16,"tag":17,"props":1340,"children":1341},{},[1342],{"type":21,"value":1343},"The handler itself is then refreshingly short, in the way good handlers tend to be:",{"type":16,"tag":139,"props":1345,"children":1347},{"code":1346,"language":1115,"meta":7,"className":1116,"style":7},"def handler(event, _context):\n attrs = event.get(\"request\", {}).get(\"userAttributes\", {}) or {}\n groups = _parse_groups(attrs.get(\"custom:entra_groups\", \"\"))\n\n event[\"response\"] = {\n \"claimsAndScopeOverrideDetails\": {\n \"groupOverrideDetails\": {\n \"groupsToOverride\": groups,\n }\n }\n }\n return event\n",[1348],{"type":16,"tag":72,"props":1349,"children":1350},{"__ignoreMap":7},[1351,1368,1415,1451,1458,1484,1497,1509,1522,1530,1538,1545],{"type":16,"tag":228,"props":1352,"children":1353},{"class":230,"line":231},[1354,1358,1363],{"type":16,"tag":228,"props":1355,"children":1356},{"style":262},[1357],{"type":21,"value":1128},{"type":16,"tag":228,"props":1359,"children":1360},{"style":235},[1361],{"type":21,"value":1362}," handler",{"type":16,"tag":228,"props":1364,"children":1365},{"style":247},[1366],{"type":21,"value":1367},"(event, _context):\n",{"type":16,"tag":228,"props":1369,"children":1370},{"class":230,"line":253},[1371,1376,1380,1385,1390,1395,1400,1405,1410],{"type":16,"tag":228,"props":1372,"children":1373},{"style":247},[1374],{"type":21,"value":1375}," attrs ",{"type":16,"tag":228,"props":1377,"children":1378},{"style":262},[1379],{"type":21,"value":846},{"type":16,"tag":228,"props":1381,"children":1382},{"style":247},[1383],{"type":21,"value":1384}," event.get(",{"type":16,"tag":228,"props":1386,"children":1387},{"style":268},[1388],{"type":21,"value":1389},"\"request\"",{"type":16,"tag":228,"props":1391,"children":1392},{"style":247},[1393],{"type":21,"value":1394},", {}).get(",{"type":16,"tag":228,"props":1396,"children":1397},{"style":268},[1398],{"type":21,"value":1399},"\"userAttributes\"",{"type":16,"tag":228,"props":1401,"children":1402},{"style":247},[1403],{"type":21,"value":1404},", {}) ",{"type":16,"tag":228,"props":1406,"children":1407},{"style":262},[1408],{"type":21,"value":1409},"or",{"type":16,"tag":228,"props":1411,"children":1412},{"style":247},[1413],{"type":21,"value":1414}," {}\n",{"type":16,"tag":228,"props":1416,"children":1417},{"class":230,"line":274},[1418,1423,1427,1432,1437,1441,1446],{"type":16,"tag":228,"props":1419,"children":1420},{"style":247},[1421],{"type":21,"value":1422}," groups ",{"type":16,"tag":228,"props":1424,"children":1425},{"style":262},[1426],{"type":21,"value":846},{"type":16,"tag":228,"props":1428,"children":1429},{"style":247},[1430],{"type":21,"value":1431}," _parse_groups(attrs.get(",{"type":16,"tag":228,"props":1433,"children":1434},{"style":268},[1435],{"type":21,"value":1436},"\"custom:entra_groups\"",{"type":16,"tag":228,"props":1438,"children":1439},{"style":247},[1440],{"type":21,"value":721},{"type":16,"tag":228,"props":1442,"children":1443},{"style":268},[1444],{"type":21,"value":1445},"\"\"",{"type":16,"tag":228,"props":1447,"children":1448},{"style":247},[1449],{"type":21,"value":1450},"))\n",{"type":16,"tag":228,"props":1452,"children":1453},{"class":230,"line":284},[1454],{"type":16,"tag":228,"props":1455,"children":1456},{"emptyLinePlaceholder":278},[1457],{"type":21,"value":281},{"type":16,"tag":228,"props":1459,"children":1460},{"class":230,"line":303},[1461,1466,1471,1476,1480],{"type":16,"tag":228,"props":1462,"children":1463},{"style":247},[1464],{"type":21,"value":1465}," event[",{"type":16,"tag":228,"props":1467,"children":1468},{"style":268},[1469],{"type":21,"value":1470},"\"response\"",{"type":16,"tag":228,"props":1472,"children":1473},{"style":247},[1474],{"type":21,"value":1475},"] ",{"type":16,"tag":228,"props":1477,"children":1478},{"style":262},[1479],{"type":21,"value":846},{"type":16,"tag":228,"props":1481,"children":1482},{"style":247},[1483],{"type":21,"value":250},{"type":16,"tag":228,"props":1485,"children":1486},{"class":230,"line":321},[1487,1492],{"type":16,"tag":228,"props":1488,"children":1489},{"style":268},[1490],{"type":21,"value":1491}," \"claimsAndScopeOverrideDetails\"",{"type":16,"tag":228,"props":1493,"children":1494},{"style":247},[1495],{"type":21,"value":1496},": {\n",{"type":16,"tag":228,"props":1498,"children":1499},{"class":230,"line":329},[1500,1505],{"type":16,"tag":228,"props":1501,"children":1502},{"style":268},[1503],{"type":21,"value":1504}," \"groupOverrideDetails\"",{"type":16,"tag":228,"props":1506,"children":1507},{"style":247},[1508],{"type":21,"value":1496},{"type":16,"tag":228,"props":1510,"children":1511},{"class":230,"line":357},[1512,1517],{"type":16,"tag":228,"props":1513,"children":1514},{"style":268},[1515],{"type":21,"value":1516}," \"groupsToOverride\"",{"type":16,"tag":228,"props":1518,"children":1519},{"style":247},[1520],{"type":21,"value":1521},": groups,\n",{"type":16,"tag":228,"props":1523,"children":1524},{"class":230,"line":384},[1525],{"type":16,"tag":228,"props":1526,"children":1527},{"style":247},[1528],{"type":21,"value":1529}," }\n",{"type":16,"tag":228,"props":1531,"children":1532},{"class":230,"line":578},[1533],{"type":16,"tag":228,"props":1534,"children":1535},{"style":247},[1536],{"type":21,"value":1537}," }\n",{"type":16,"tag":228,"props":1539,"children":1540},{"class":230,"line":596},[1541],{"type":16,"tag":228,"props":1542,"children":1543},{"style":247},[1544],{"type":21,"value":652},{"type":16,"tag":228,"props":1546,"children":1547},{"class":230,"line":615},[1548,1552],{"type":16,"tag":228,"props":1549,"children":1550},{"style":262},[1551],{"type":21,"value":1294},{"type":16,"tag":228,"props":1553,"children":1554},{"style":247},[1555],{"type":21,"value":1556}," event\n",{"type":16,"tag":17,"props":1558,"children":1559},{},[1560,1562,1567],{"type":21,"value":1561},"After this, every token Cognito issues for an Entra-federated user contains a ",{"type":16,"tag":72,"props":1563,"children":1565},{"className":1564},[],[1566],{"type":21,"value":85},{"type":21,"value":1568}," claim with the user's Entra group IDs.",{"type":16,"tag":60,"props":1570,"children":1572},{"id":1571},"what-this-unlocks",[1573],{"type":21,"value":1574},"What this unlocks",{"type":16,"tag":17,"props":1576,"children":1577},{},[1578],{"type":21,"value":1579},"Getting Entra groups onto a normal JWT claim sounds small, but it changes the shape of the next half-dozen problems that usually follow it.",{"type":16,"tag":17,"props":1581,"children":1582},{},[1583],{"type":21,"value":1584},"A few things you can do once the groups are in the token:",{"type":16,"tag":101,"props":1586,"children":1587},{},[1588,1605,1615,1625,1635,1645],{"type":16,"tag":105,"props":1589,"children":1590},{},[1591,1596,1598,1603],{"type":16,"tag":42,"props":1592,"children":1593},{},[1594],{"type":21,"value":1595},"API Gateway Lambda authorisers doing real RBAC.",{"type":21,"value":1597}," A custom authoriser decodes the JWT, reads ",{"type":16,"tag":72,"props":1599,"children":1601},{"className":1600},[],[1602],{"type":21,"value":85},{"type":21,"value":1604},", intersects with a per-route policy and returns an IAM policy document. No Graph calls, no second round-trip to anywhere, no extra caching layer to invalidate, and API Gateway will cache the authoriser response for a configurable TTL on top.",{"type":16,"tag":105,"props":1606,"children":1607},{},[1608,1613],{"type":16,"tag":42,"props":1609,"children":1610},{},[1611],{"type":21,"value":1612},"Frontend role-gating that matches the backend.",{"type":21,"value":1614}," The same claim is on the ID token, so a Vue or React app can hide actions, menu items, or whole routes based on the user's Entra groups, knowing the backend is enforcing the same answer for free.",{"type":16,"tag":105,"props":1616,"children":1617},{},[1618,1623],{"type":16,"tag":42,"props":1619,"children":1620},{},[1621],{"type":21,"value":1622},"Fine-grained AWS access via a Cognito Identity Pool.",{"type":21,"value":1624}," Map specific Entra groups to IAM roles using Identity Pool group precedence, and a user's temporary AWS credentials end up scoped to exactly what their group memberships should allow, per-team S3 prefixes, per-team DynamoDB partitions, and so on, without per-team auth code.",{"type":16,"tag":105,"props":1626,"children":1627},{},[1628,1633],{"type":16,"tag":42,"props":1629,"children":1630},{},[1631],{"type":21,"value":1632},"Audit logs that reference real org structure.",{"type":21,"value":1634}," If your audit pipeline persists the group claim alongside each action, your investigations get to talk about \"Finance\" or \"EngineeringLeads\" instead of opaque user IDs.",{"type":16,"tag":105,"props":1636,"children":1637},{},[1638,1643],{"type":16,"tag":42,"props":1639,"children":1640},{},[1641],{"type":21,"value":1642},"Feature flags driven by group membership.",{"type":21,"value":1644}," Reading the claim once in middleware and feeding it into LaunchDarkly or a homegrown flag service means rollouts can target real org boundaries without the flag service needing its own user directory.",{"type":16,"tag":105,"props":1646,"children":1647},{},[1648,1653],{"type":16,"tag":42,"props":1649,"children":1650},{},[1651],{"type":21,"value":1652},"Per-tenant data isolation.",{"type":21,"value":1654}," In a multi-tenant API where each tenant maps to an Entra group, the claim becomes the source of truth for row-level scoping in your queries, and the rule is enforced at the edge, not buried in the data layer.",{"type":16,"tag":17,"props":1656,"children":1657},{},[1658,1660,1665],{"type":21,"value":1659},"The common thread is that the ",{"type":16,"tag":24,"props":1661,"children":1662},{},[1663],{"type":21,"value":1664},"integration",{"type":21,"value":1666}," problem gets solved exactly once, at the auth boundary, and everything downstream gets to treat groups as a normal Cognito concept.",{"type":16,"tag":60,"props":1668,"children":1670},{"id":1669},"a-caveat",[1671],{"type":21,"value":1672},"A caveat",{"type":16,"tag":17,"props":1674,"children":1675},{},[1676,1678,1683],{"type":21,"value":1677},"The pattern itself is taken from a real client integration that worked. The snippets in this write-up are a re-write done for the article: minimal, opinionated, and ",{"type":16,"tag":42,"props":1679,"children":1680},{},[1681],{"type":21,"value":1682},"not yet a tested end-to-end module",{"type":21,"value":1684},". Treat them as a reference for the moving parts rather than a copy-paste production-ready setup, and you will not be sad.",{"type":16,"tag":17,"props":1686,"children":1687},{},[1688],{"type":21,"value":1689},"If you ship something based on it, I would genuinely love to hear what hit you that wasn't covered here 🤝",{"type":16,"tag":1691,"props":1692,"children":1693},"style",{},[1694],{"type":21,"value":1695},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":7,"searchDepth":253,"depth":253,"links":1697},[1698,1699,1700,1707,1708],{"id":62,"depth":253,"text":65},{"id":134,"depth":253,"text":137},{"id":398,"depth":253,"text":401,"children":1701},[1702,1703,1705,1706],{"id":410,"depth":274,"text":413},{"id":671,"depth":274,"text":1704},"2. MetadataURL populates other fields you must also ignore",{"id":949,"depth":274,"text":952},{"id":1077,"depth":274,"text":1080},{"id":1571,"depth":253,"text":1574},{"id":1669,"depth":253,"text":1672},"markdown","content:articles:wiring-entra-id-into-aws-cognito.md","content","articles/wiring-entra-id-into-aws-cognito.md","articles/wiring-entra-id-into-aws-cognito","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"published":10,"slug":11,"body":1716,"_type":1709,"_id":1710,"_source":1711,"_file":1712,"_stem":1713,"_extension":1714},{"type":13,"children":1717,"toc":3113},[1718,1727,1731,1739,1748,1752,1773,1777,1788,1802,1806,1813,1817,1865,1869,2002,2006,2010,2014,2018,2022,2236,2246,2267,2282,2478,2482,2486,2501,2589,2593,2597,2607,2614,2623,2814,2818,3004,3014,3018,3022,3026,3083,3092,3096,3105,3109],{"type":16,"tag":17,"props":1719,"children":1720},{},[1721,1722,1726],{"type":21,"value":22},{"type":16,"tag":24,"props":1723,"children":1724},{},[1725],{"type":21,"value":28},{"type":21,"value":30},{"type":16,"tag":17,"props":1728,"children":1729},{},[1730],{"type":21,"value":35},{"type":16,"tag":17,"props":1732,"children":1733},{},[1734,1735],{"type":21,"value":40},{"type":16,"tag":42,"props":1736,"children":1737},{},[1738],{"type":21,"value":46},{"type":16,"tag":17,"props":1740,"children":1741},{},[1742,1743,1747],{"type":21,"value":51},{"type":16,"tag":24,"props":1744,"children":1745},{},[1746],{"type":21,"value":56},{"type":21,"value":58},{"type":16,"tag":60,"props":1749,"children":1750},{"id":62},[1751],{"type":21,"value":65},{"type":16,"tag":17,"props":1753,"children":1754},{},[1755,1756,1761,1762,1767,1768,1772],{"type":21,"value":70},{"type":16,"tag":72,"props":1757,"children":1759},{"className":1758},[],[1760],{"type":21,"value":77},{"type":21,"value":79},{"type":16,"tag":72,"props":1763,"children":1765},{"className":1764},[],[1766],{"type":21,"value":85},{"type":21,"value":87},{"type":16,"tag":24,"props":1769,"children":1770},{},[1771],{"type":21,"value":92},{"type":21,"value":94},{"type":16,"tag":17,"props":1774,"children":1775},{},[1776],{"type":21,"value":99},{"type":16,"tag":101,"props":1778,"children":1779},{},[1780,1784],{"type":16,"tag":105,"props":1781,"children":1782},{},[1783],{"type":21,"value":109},{"type":16,"tag":105,"props":1785,"children":1786},{},[1787],{"type":21,"value":114},{"type":16,"tag":17,"props":1789,"children":1790},{},[1791,1792],{"type":21,"value":119},{"type":16,"tag":42,"props":1793,"children":1794},{},[1795,1796,1801],{"type":21,"value":124},{"type":16,"tag":72,"props":1797,"children":1799},{"className":1798},[],[1800],{"type":21,"value":85},{"type":21,"value":131},{"type":16,"tag":60,"props":1803,"children":1804},{"id":134},[1805],{"type":21,"value":137},{"type":16,"tag":139,"props":1807,"children":1808},{"code":141},[1809],{"type":16,"tag":72,"props":1810,"children":1811},{"__ignoreMap":7},[1812],{"type":21,"value":141},{"type":16,"tag":17,"props":1814,"children":1815},{},[1816],{"type":21,"value":151},{"type":16,"tag":153,"props":1818,"children":1819},{},[1820,1835,1861],{"type":16,"tag":105,"props":1821,"children":1822},{},[1823,1824,1828,1829,1834],{"type":21,"value":160},{"type":16,"tag":42,"props":1825,"children":1826},{},[1827],{"type":21,"value":165},{"type":21,"value":167},{"type":16,"tag":72,"props":1830,"children":1832},{"className":1831},[],[1833],{"type":21,"value":173},{"type":21,"value":175},{"type":16,"tag":105,"props":1836,"children":1837},{},[1838,1839,1843,1844,1849,1850,1855,1856,1860],{"type":21,"value":160},{"type":16,"tag":42,"props":1840,"children":1841},{},[1842],{"type":21,"value":184},{"type":21,"value":186},{"type":16,"tag":72,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":21,"value":173},{"type":21,"value":193},{"type":16,"tag":72,"props":1851,"children":1853},{"className":1852},[],[1854],{"type":21,"value":85},{"type":21,"value":200},{"type":16,"tag":42,"props":1857,"children":1858},{},[1859],{"type":21,"value":205},{"type":21,"value":207},{"type":16,"tag":105,"props":1862,"children":1863},{},[1864],{"type":21,"value":212},{"type":16,"tag":17,"props":1866,"children":1867},{},[1868],{"type":21,"value":217},{"type":16,"tag":139,"props":1870,"children":1871},{"code":220,"language":221,"meta":7,"className":222,"style":7},[1872],{"type":16,"tag":72,"props":1873,"children":1874},{"__ignoreMap":7},[1875,1890,1905,1912,1927,1942,1949,1972,1995],{"type":16,"tag":228,"props":1876,"children":1877},{"class":230,"line":231},[1878,1882,1886],{"type":16,"tag":228,"props":1879,"children":1880},{"style":235},[1881],{"type":21,"value":238},{"type":16,"tag":228,"props":1883,"children":1884},{"style":241},[1885],{"type":21,"value":244},{"type":16,"tag":228,"props":1887,"children":1888},{"style":247},[1889],{"type":21,"value":250},{"type":16,"tag":228,"props":1891,"children":1892},{"class":230,"line":253},[1893,1897,1901],{"type":16,"tag":228,"props":1894,"children":1895},{"style":247},[1896],{"type":21,"value":259},{"type":16,"tag":228,"props":1898,"children":1899},{"style":262},[1900],{"type":21,"value":265},{"type":16,"tag":228,"props":1902,"children":1903},{"style":268},[1904],{"type":21,"value":271},{"type":16,"tag":228,"props":1906,"children":1907},{"class":230,"line":274},[1908],{"type":16,"tag":228,"props":1909,"children":1910},{"emptyLinePlaceholder":278},[1911],{"type":21,"value":281},{"type":16,"tag":228,"props":1913,"children":1914},{"class":230,"line":284},[1915,1919,1923],{"type":16,"tag":228,"props":1916,"children":1917},{"style":247},[1918],{"type":21,"value":290},{"type":16,"tag":228,"props":1920,"children":1921},{"style":262},[1922],{"type":21,"value":295},{"type":16,"tag":228,"props":1924,"children":1925},{"style":268},[1926],{"type":21,"value":300},{"type":16,"tag":228,"props":1928,"children":1929},{"class":230,"line":303},[1930,1934,1938],{"type":16,"tag":228,"props":1931,"children":1932},{"style":247},[1933],{"type":21,"value":309},{"type":16,"tag":228,"props":1935,"children":1936},{"style":262},[1937],{"type":21,"value":265},{"type":16,"tag":228,"props":1939,"children":1940},{"style":268},[1941],{"type":21,"value":318},{"type":16,"tag":228,"props":1943,"children":1944},{"class":230,"line":321},[1945],{"type":16,"tag":228,"props":1946,"children":1947},{"emptyLinePlaceholder":278},[1948],{"type":21,"value":281},{"type":16,"tag":228,"props":1950,"children":1951},{"class":230,"line":329},[1952,1956,1960,1964,1968],{"type":16,"tag":228,"props":1953,"children":1954},{"style":247},[1955],{"type":21,"value":335},{"type":16,"tag":228,"props":1957,"children":1958},{"style":262},[1959],{"type":21,"value":265},{"type":16,"tag":228,"props":1961,"children":1962},{"style":247},[1963],{"type":21,"value":344},{"type":16,"tag":228,"props":1965,"children":1966},{"style":268},[1967],{"type":21,"value":349},{"type":16,"tag":228,"props":1969,"children":1970},{"style":247},[1971],{"type":21,"value":354},{"type":16,"tag":228,"props":1973,"children":1974},{"class":230,"line":357},[1975,1979,1983,1987,1991],{"type":16,"tag":228,"props":1976,"children":1977},{"style":247},[1978],{"type":21,"value":363},{"type":16,"tag":228,"props":1980,"children":1981},{"style":262},[1982],{"type":21,"value":368},{"type":16,"tag":228,"props":1984,"children":1985},{"style":247},[1986],{"type":21,"value":344},{"type":16,"tag":228,"props":1988,"children":1989},{"style":268},[1990],{"type":21,"value":377},{"type":16,"tag":228,"props":1992,"children":1993},{"style":247},[1994],{"type":21,"value":354},{"type":16,"tag":228,"props":1996,"children":1997},{"class":230,"line":384},[1998],{"type":16,"tag":228,"props":1999,"children":2000},{"style":247},[2001],{"type":21,"value":390},{"type":16,"tag":17,"props":2003,"children":2004},{},[2005],{"type":21,"value":395},{"type":16,"tag":60,"props":2007,"children":2008},{"id":398},[2009],{"type":21,"value":401},{"type":16,"tag":17,"props":2011,"children":2012},{},[2013],{"type":21,"value":406},{"type":16,"tag":408,"props":2015,"children":2016},{"id":410},[2017],{"type":21,"value":413},{"type":16,"tag":17,"props":2019,"children":2020},{},[2021],{"type":21,"value":418},{"type":16,"tag":139,"props":2023,"children":2024},{"code":421,"language":221,"meta":7,"className":222,"style":7},[2025],{"type":16,"tag":72,"props":2026,"children":2027},{"__ignoreMap":7},[2028,2047,2086,2093,2104,2119,2126,2133,2144,2159,2174,2189,2200,2215,2222,2229],{"type":16,"tag":228,"props":2029,"children":2030},{"class":230,"line":231},[2031,2035,2039,2043],{"type":16,"tag":228,"props":2032,"children":2033},{"style":235},[2034],{"type":21,"value":433},{"type":16,"tag":228,"props":2036,"children":2037},{"style":241},[2038],{"type":21,"value":438},{"type":16,"tag":228,"props":2040,"children":2041},{"style":241},[2042],{"type":21,"value":443},{"type":16,"tag":228,"props":2044,"children":2045},{"style":247},[2046],{"type":21,"value":250},{"type":16,"tag":228,"props":2048,"children":2049},{"class":230,"line":253},[2050,2054,2058,2062,2066,2070,2074,2078,2082],{"type":16,"tag":228,"props":2051,"children":2052},{"style":247},[2053],{"type":21,"value":455},{"type":16,"tag":228,"props":2055,"children":2056},{"style":262},[2057],{"type":21,"value":265},{"type":16,"tag":228,"props":2059,"children":2060},{"style":268},[2061],{"type":21,"value":464},{"type":16,"tag":228,"props":2063,"children":2064},{"style":262},[2065],{"type":21,"value":469},{"type":16,"tag":228,"props":2067,"children":2068},{"style":247},[2069],{"type":21,"value":474},{"type":16,"tag":228,"props":2071,"children":2072},{"style":262},[2073],{"type":21,"value":479},{"type":16,"tag":228,"props":2075,"children":2076},{"style":247},[2077],{"type":21,"value":484},{"type":16,"tag":228,"props":2079,"children":2080},{"style":262},[2081],{"type":21,"value":489},{"type":16,"tag":228,"props":2083,"children":2084},{"style":268},[2085],{"type":21,"value":494},{"type":16,"tag":228,"props":2087,"children":2088},{"class":230,"line":274},[2089],{"type":16,"tag":228,"props":2090,"children":2091},{"emptyLinePlaceholder":278},[2092],{"type":21,"value":281},{"type":16,"tag":228,"props":2094,"children":2095},{"class":230,"line":284},[2096,2100],{"type":16,"tag":228,"props":2097,"children":2098},{"style":235},[2099],{"type":21,"value":509},{"type":16,"tag":228,"props":2101,"children":2102},{"style":247},[2103],{"type":21,"value":250},{"type":16,"tag":228,"props":2105,"children":2106},{"class":230,"line":303},[2107,2111,2115],{"type":16,"tag":228,"props":2108,"children":2109},{"style":247},[2110],{"type":21,"value":521},{"type":16,"tag":228,"props":2112,"children":2113},{"style":262},[2114],{"type":21,"value":265},{"type":16,"tag":228,"props":2116,"children":2117},{"style":247},[2118],{"type":21,"value":530},{"type":16,"tag":228,"props":2120,"children":2121},{"class":230,"line":321},[2122],{"type":16,"tag":228,"props":2123,"children":2124},{"style":247},[2125],{"type":21,"value":538},{"type":16,"tag":228,"props":2127,"children":2128},{"class":230,"line":329},[2129],{"type":16,"tag":228,"props":2130,"children":2131},{"emptyLinePlaceholder":278},[2132],{"type":21,"value":281},{"type":16,"tag":228,"props":2134,"children":2135},{"class":230,"line":357},[2136,2140],{"type":16,"tag":228,"props":2137,"children":2138},{"style":235},[2139],{"type":21,"value":553},{"type":16,"tag":228,"props":2141,"children":2142},{"style":247},[2143],{"type":21,"value":250},{"type":16,"tag":228,"props":2145,"children":2146},{"class":230,"line":384},[2147,2151,2155],{"type":16,"tag":228,"props":2148,"children":2149},{"style":247},[2150],{"type":21,"value":565},{"type":16,"tag":228,"props":2152,"children":2153},{"style":262},[2154],{"type":21,"value":570},{"type":16,"tag":228,"props":2156,"children":2157},{"style":268},[2158],{"type":21,"value":575},{"type":16,"tag":228,"props":2160,"children":2161},{"class":230,"line":578},[2162,2166,2170],{"type":16,"tag":228,"props":2163,"children":2164},{"style":247},[2165],{"type":21,"value":584},{"type":16,"tag":228,"props":2167,"children":2168},{"style":262},[2169],{"type":21,"value":265},{"type":16,"tag":228,"props":2171,"children":2172},{"style":268},[2173],{"type":21,"value":593},{"type":16,"tag":228,"props":2175,"children":2176},{"class":230,"line":596},[2177,2181,2185],{"type":16,"tag":228,"props":2178,"children":2179},{"style":247},[2180],{"type":21,"value":602},{"type":16,"tag":228,"props":2182,"children":2183},{"style":262},[2184],{"type":21,"value":607},{"type":16,"tag":228,"props":2186,"children":2187},{"style":241},[2188],{"type":21,"value":612},{"type":16,"tag":228,"props":2190,"children":2191},{"class":230,"line":615},[2192,2196],{"type":16,"tag":228,"props":2193,"children":2194},{"style":235},[2195],{"type":21,"value":621},{"type":16,"tag":228,"props":2197,"children":2198},{"style":247},[2199],{"type":21,"value":250},{"type":16,"tag":228,"props":2201,"children":2202},{"class":230,"line":628},[2203,2207,2211],{"type":16,"tag":228,"props":2204,"children":2205},{"style":247},[2206],{"type":21,"value":634},{"type":16,"tag":228,"props":2208,"children":2209},{"style":262},[2210],{"type":21,"value":265},{"type":16,"tag":228,"props":2212,"children":2213},{"style":268},[2214],{"type":21,"value":643},{"type":16,"tag":228,"props":2216,"children":2217},{"class":230,"line":646},[2218],{"type":16,"tag":228,"props":2219,"children":2220},{"style":247},[2221],{"type":21,"value":652},{"type":16,"tag":228,"props":2223,"children":2224},{"class":230,"line":655},[2225],{"type":16,"tag":228,"props":2226,"children":2227},{"style":247},[2228],{"type":21,"value":538},{"type":16,"tag":228,"props":2230,"children":2231},{"class":230,"line":663},[2232],{"type":16,"tag":228,"props":2233,"children":2234},{"style":247},[2235],{"type":21,"value":390},{"type":16,"tag":408,"props":2237,"children":2238},{"id":671},[2239,2240,2245],{"type":21,"value":674},{"type":16,"tag":72,"props":2241,"children":2243},{"className":2242},[],[2244],{"type":21,"value":680},{"type":21,"value":682},{"type":16,"tag":17,"props":2247,"children":2248},{},[2249,2250,2255,2256,2260,2261,2266],{"type":21,"value":687},{"type":16,"tag":72,"props":2251,"children":2253},{"className":2252},[],[2254],{"type":21,"value":680},{"type":21,"value":694},{"type":16,"tag":24,"props":2257,"children":2258},{},[2259],{"type":21,"value":699},{"type":21,"value":701},{"type":16,"tag":72,"props":2262,"children":2264},{"className":2263},[],[2265],{"type":21,"value":707},{"type":21,"value":709},{"type":16,"tag":17,"props":2268,"children":2269},{},[2270,2271,2276,2277,2281],{"type":21,"value":714},{"type":16,"tag":72,"props":2272,"children":2274},{"className":2273},[],[2275],{"type":21,"value":707},{"type":21,"value":721},{"type":16,"tag":42,"props":2278,"children":2279},{},[2280],{"type":21,"value":726},{"type":21,"value":728},{"type":16,"tag":139,"props":2283,"children":2284},{"code":731,"language":221,"meta":7,"className":222,"style":7},[2285],{"type":16,"tag":72,"props":2286,"children":2287},{"__ignoreMap":7},[2288,2307,2330,2337,2344,2363,2378,2393,2400,2407,2418,2433,2464,2471],{"type":16,"tag":228,"props":2289,"children":2290},{"class":230,"line":231},[2291,2295,2299,2303],{"type":16,"tag":228,"props":2292,"children":2293},{"style":235},[2294],{"type":21,"value":433},{"type":16,"tag":228,"props":2296,"children":2297},{"style":241},[2298],{"type":21,"value":747},{"type":16,"tag":228,"props":2300,"children":2301},{"style":241},[2302],{"type":21,"value":752},{"type":16,"tag":228,"props":2304,"children":2305},{"style":247},[2306],{"type":21,"value":250},{"type":16,"tag":228,"props":2308,"children":2309},{"class":230,"line":253},[2310,2314,2318,2322,2326],{"type":16,"tag":228,"props":2311,"children":2312},{"style":247},[2313],{"type":21,"value":764},{"type":16,"tag":228,"props":2315,"children":2316},{"style":262},[2317],{"type":21,"value":265},{"type":16,"tag":228,"props":2319,"children":2320},{"style":247},[2321],{"type":21,"value":773},{"type":16,"tag":228,"props":2323,"children":2324},{"style":262},[2325],{"type":21,"value":479},{"type":16,"tag":228,"props":2327,"children":2328},{"style":247},[2329],{"type":21,"value":782},{"type":16,"tag":228,"props":2331,"children":2332},{"class":230,"line":274},[2333],{"type":16,"tag":228,"props":2334,"children":2335},{"style":247},[2336],{"type":21,"value":390},{"type":16,"tag":228,"props":2338,"children":2339},{"class":230,"line":284},[2340],{"type":16,"tag":228,"props":2341,"children":2342},{"emptyLinePlaceholder":278},[2343],{"type":21,"value":281},{"type":16,"tag":228,"props":2345,"children":2346},{"class":230,"line":303},[2347,2351,2355,2359],{"type":16,"tag":228,"props":2348,"children":2349},{"style":235},[2350],{"type":21,"value":433},{"type":16,"tag":228,"props":2352,"children":2353},{"style":241},[2354],{"type":21,"value":808},{"type":16,"tag":228,"props":2356,"children":2357},{"style":241},[2358],{"type":21,"value":813},{"type":16,"tag":228,"props":2360,"children":2361},{"style":247},[2362],{"type":21,"value":250},{"type":16,"tag":228,"props":2364,"children":2365},{"class":230,"line":321},[2366,2370,2374],{"type":16,"tag":228,"props":2367,"children":2368},{"style":247},[2369],{"type":21,"value":825},{"type":16,"tag":228,"props":2371,"children":2372},{"style":262},[2373],{"type":21,"value":265},{"type":16,"tag":228,"props":2375,"children":2376},{"style":247},[2377],{"type":21,"value":250},{"type":16,"tag":228,"props":2379,"children":2380},{"class":230,"line":329},[2381,2385,2389],{"type":16,"tag":228,"props":2382,"children":2383},{"style":247},[2384],{"type":21,"value":841},{"type":16,"tag":228,"props":2386,"children":2387},{"style":262},[2388],{"type":21,"value":846},{"type":16,"tag":228,"props":2390,"children":2391},{"style":247},[2392],{"type":21,"value":851},{"type":16,"tag":228,"props":2394,"children":2395},{"class":230,"line":357},[2396],{"type":16,"tag":228,"props":2397,"children":2398},{"style":247},[2399],{"type":21,"value":538},{"type":16,"tag":228,"props":2401,"children":2402},{"class":230,"line":384},[2403],{"type":16,"tag":228,"props":2404,"children":2405},{"emptyLinePlaceholder":278},[2406],{"type":21,"value":281},{"type":16,"tag":228,"props":2408,"children":2409},{"class":230,"line":578},[2410,2414],{"type":16,"tag":228,"props":2411,"children":2412},{"style":235},[2413],{"type":21,"value":509},{"type":16,"tag":228,"props":2415,"children":2416},{"style":247},[2417],{"type":21,"value":250},{"type":16,"tag":228,"props":2419,"children":2420},{"class":230,"line":596},[2421,2425,2429],{"type":16,"tag":228,"props":2422,"children":2423},{"style":247},[2424],{"type":21,"value":521},{"type":16,"tag":228,"props":2426,"children":2427},{"style":262},[2428],{"type":21,"value":295},{"type":16,"tag":228,"props":2430,"children":2431},{"style":247},[2432],{"type":21,"value":892},{"type":16,"tag":228,"props":2434,"children":2435},{"class":230,"line":615},[2436,2440,2444,2448,2452,2456,2460],{"type":16,"tag":228,"props":2437,"children":2438},{"style":247},[2439],{"type":21,"value":900},{"type":16,"tag":228,"props":2441,"children":2442},{"style":262},[2443],{"type":21,"value":265},{"type":16,"tag":228,"props":2445,"children":2446},{"style":247},[2447],{"type":21,"value":909},{"type":16,"tag":228,"props":2449,"children":2450},{"style":262},[2451],{"type":21,"value":479},{"type":16,"tag":228,"props":2453,"children":2454},{"style":247},[2455],{"type":21,"value":918},{"type":16,"tag":228,"props":2457,"children":2458},{"style":262},[2459],{"type":21,"value":479},{"type":16,"tag":228,"props":2461,"children":2462},{"style":247},[2463],{"type":21,"value":927},{"type":16,"tag":228,"props":2465,"children":2466},{"class":230,"line":628},[2467],{"type":16,"tag":228,"props":2468,"children":2469},{"style":247},[2470],{"type":21,"value":538},{"type":16,"tag":228,"props":2472,"children":2473},{"class":230,"line":646},[2474],{"type":16,"tag":228,"props":2475,"children":2476},{"style":247},[2477],{"type":21,"value":390},{"type":16,"tag":17,"props":2479,"children":2480},{},[2481],{"type":21,"value":946},{"type":16,"tag":408,"props":2483,"children":2484},{"id":949},[2485],{"type":21,"value":952},{"type":16,"tag":17,"props":2487,"children":2488},{},[2489,2490,2495,2496,2500],{"type":21,"value":957},{"type":16,"tag":72,"props":2491,"children":2493},{"className":2492},[],[2494],{"type":21,"value":85},{"type":21,"value":964},{"type":16,"tag":42,"props":2497,"children":2498},{},[2499],{"type":21,"value":969},{"type":21,"value":971},{"type":16,"tag":139,"props":2502,"children":2503},{"code":974,"language":221,"meta":7,"className":222,"style":7},[2504],{"type":16,"tag":72,"props":2505,"children":2506},{"__ignoreMap":7},[2507,2518,2529,2560,2575,2582],{"type":16,"tag":228,"props":2508,"children":2509},{"class":230,"line":231},[2510,2514],{"type":16,"tag":228,"props":2511,"children":2512},{"style":235},[2513],{"type":21,"value":986},{"type":16,"tag":228,"props":2515,"children":2516},{"style":247},[2517],{"type":21,"value":250},{"type":16,"tag":228,"props":2519,"children":2520},{"class":230,"line":253},[2521,2525],{"type":16,"tag":228,"props":2522,"children":2523},{"style":235},[2524],{"type":21,"value":998},{"type":16,"tag":228,"props":2526,"children":2527},{"style":247},[2528],{"type":21,"value":250},{"type":16,"tag":228,"props":2530,"children":2531},{"class":230,"line":274},[2532,2536,2540,2544,2548,2552,2556],{"type":16,"tag":228,"props":2533,"children":2534},{"style":247},[2535],{"type":21,"value":1010},{"type":16,"tag":228,"props":2537,"children":2538},{"style":262},[2539],{"type":21,"value":1015},{"type":16,"tag":228,"props":2541,"children":2542},{"style":247},[2543],{"type":21,"value":1020},{"type":16,"tag":228,"props":2545,"children":2546},{"style":262},[2547],{"type":21,"value":479},{"type":16,"tag":228,"props":2549,"children":2550},{"style":247},[2551],{"type":21,"value":1029},{"type":16,"tag":228,"props":2553,"children":2554},{"style":262},[2555],{"type":21,"value":479},{"type":16,"tag":228,"props":2557,"children":2558},{"style":247},[2559],{"type":21,"value":1038},{"type":16,"tag":228,"props":2561,"children":2562},{"class":230,"line":284},[2563,2567,2571],{"type":16,"tag":228,"props":2564,"children":2565},{"style":247},[2566],{"type":21,"value":1046},{"type":16,"tag":228,"props":2568,"children":2569},{"style":262},[2570],{"type":21,"value":265},{"type":16,"tag":228,"props":2572,"children":2573},{"style":268},[2574],{"type":21,"value":1055},{"type":16,"tag":228,"props":2576,"children":2577},{"class":230,"line":303},[2578],{"type":16,"tag":228,"props":2579,"children":2580},{"style":247},[2581],{"type":21,"value":538},{"type":16,"tag":228,"props":2583,"children":2584},{"class":230,"line":321},[2585],{"type":16,"tag":228,"props":2586,"children":2587},{"style":247},[2588],{"type":21,"value":390},{"type":16,"tag":17,"props":2590,"children":2591},{},[2592],{"type":21,"value":1074},{"type":16,"tag":408,"props":2594,"children":2595},{"id":1077},[2596],{"type":21,"value":1080},{"type":16,"tag":17,"props":2598,"children":2599},{},[2600,2601,2606],{"type":21,"value":1085},{"type":16,"tag":72,"props":2602,"children":2604},{"className":2603},[],[2605],{"type":21,"value":173},{"type":21,"value":1092},{"type":16,"tag":139,"props":2608,"children":2609},{"code":1095},[2610],{"type":16,"tag":72,"props":2611,"children":2612},{"__ignoreMap":7},[2613],{"type":21,"value":1095},{"type":16,"tag":17,"props":2615,"children":2616},{},[2617,2622],{"type":16,"tag":72,"props":2618,"children":2620},{"className":2619},[],[2621],{"type":21,"value":1109},{"type":21,"value":1111},{"type":16,"tag":139,"props":2624,"children":2625},{"code":1114,"language":1115,"meta":7,"className":1116,"style":7},[2626],{"type":16,"tag":72,"props":2627,"children":2628},{"__ignoreMap":7},[2629,2660,2675,2686,2701,2736,2771],{"type":16,"tag":228,"props":2630,"children":2631},{"class":230,"line":231},[2632,2636,2640,2644,2648,2652,2656],{"type":16,"tag":228,"props":2633,"children":2634},{"style":262},[2635],{"type":21,"value":1128},{"type":16,"tag":228,"props":2637,"children":2638},{"style":235},[2639],{"type":21,"value":1133},{"type":16,"tag":228,"props":2641,"children":2642},{"style":247},[2643],{"type":21,"value":1138},{"type":16,"tag":228,"props":2645,"children":2646},{"style":241},[2647],{"type":21,"value":1143},{"type":16,"tag":228,"props":2649,"children":2650},{"style":247},[2651],{"type":21,"value":1148},{"type":16,"tag":228,"props":2653,"children":2654},{"style":241},[2655],{"type":21,"value":1143},{"type":16,"tag":228,"props":2657,"children":2658},{"style":247},[2659],{"type":21,"value":1157},{"type":16,"tag":228,"props":2661,"children":2662},{"class":230,"line":253},[2663,2667,2671],{"type":16,"tag":228,"props":2664,"children":2665},{"style":262},[2666],{"type":21,"value":1165},{"type":16,"tag":228,"props":2668,"children":2669},{"style":262},[2670],{"type":21,"value":1170},{"type":16,"tag":228,"props":2672,"children":2673},{"style":247},[2674],{"type":21,"value":1175},{"type":16,"tag":228,"props":2676,"children":2677},{"class":230,"line":274},[2678,2682],{"type":16,"tag":228,"props":2679,"children":2680},{"style":262},[2681],{"type":21,"value":1183},{"type":16,"tag":228,"props":2683,"children":2684},{"style":247},[2685],{"type":21,"value":1188},{"type":16,"tag":228,"props":2687,"children":2688},{"class":230,"line":284},[2689,2693,2697],{"type":16,"tag":228,"props":2690,"children":2691},{"style":247},[2692],{"type":21,"value":1196},{"type":16,"tag":228,"props":2694,"children":2695},{"style":262},[2696],{"type":21,"value":846},{"type":16,"tag":228,"props":2698,"children":2699},{"style":247},[2700],{"type":21,"value":1205},{"type":16,"tag":228,"props":2702,"children":2703},{"class":230,"line":303},[2704,2708,2712,2716,2720,2724,2728,2732],{"type":16,"tag":228,"props":2705,"children":2706},{"style":262},[2707],{"type":21,"value":1165},{"type":16,"tag":228,"props":2709,"children":2710},{"style":247},[2711],{"type":21,"value":1217},{"type":16,"tag":228,"props":2713,"children":2714},{"style":268},[2715],{"type":21,"value":1222},{"type":16,"tag":228,"props":2717,"children":2718},{"style":247},[2719],{"type":21,"value":1227},{"type":16,"tag":228,"props":2721,"children":2722},{"style":262},[2723],{"type":21,"value":726},{"type":16,"tag":228,"props":2725,"children":2726},{"style":247},[2727],{"type":21,"value":1236},{"type":16,"tag":228,"props":2729,"children":2730},{"style":268},[2731],{"type":21,"value":1241},{"type":16,"tag":228,"props":2733,"children":2734},{"style":247},[2735],{"type":21,"value":1246},{"type":16,"tag":228,"props":2737,"children":2738},{"class":230,"line":321},[2739,2743,2747,2751,2755,2759,2763,2767],{"type":16,"tag":228,"props":2740,"children":2741},{"style":247},[2742],{"type":21,"value":1254},{"type":16,"tag":228,"props":2744,"children":2745},{"style":262},[2746],{"type":21,"value":846},{"type":16,"tag":228,"props":2748,"children":2749},{"style":247},[2750],{"type":21,"value":1263},{"type":16,"tag":228,"props":2752,"children":2753},{"style":241},[2754],{"type":21,"value":1268},{"type":16,"tag":228,"props":2756,"children":2757},{"style":247},[2758],{"type":21,"value":1273},{"type":16,"tag":228,"props":2760,"children":2761},{"style":262},[2762],{"type":21,"value":1278},{"type":16,"tag":228,"props":2764,"children":2765},{"style":241},[2766],{"type":21,"value":1268},{"type":16,"tag":228,"props":2768,"children":2769},{"style":247},[2770],{"type":21,"value":354},{"type":16,"tag":228,"props":2772,"children":2773},{"class":230,"line":329},[2774,2778,2782,2786,2790,2794,2798,2802,2806,2810],{"type":16,"tag":228,"props":2775,"children":2776},{"style":262},[2777],{"type":21,"value":1294},{"type":16,"tag":228,"props":2779,"children":2780},{"style":247},[2781],{"type":21,"value":1299},{"type":16,"tag":228,"props":2783,"children":2784},{"style":262},[2785],{"type":21,"value":1304},{"type":16,"tag":228,"props":2787,"children":2788},{"style":247},[2789],{"type":21,"value":1309},{"type":16,"tag":228,"props":2791,"children":2792},{"style":262},[2793],{"type":21,"value":1314},{"type":16,"tag":228,"props":2795,"children":2796},{"style":247},[2797],{"type":21,"value":1319},{"type":16,"tag":228,"props":2799,"children":2800},{"style":268},[2801],{"type":21,"value":1324},{"type":16,"tag":228,"props":2803,"children":2804},{"style":247},[2805],{"type":21,"value":1227},{"type":16,"tag":228,"props":2807,"children":2808},{"style":262},[2809],{"type":21,"value":1333},{"type":16,"tag":228,"props":2811,"children":2812},{"style":247},[2813],{"type":21,"value":1338},{"type":16,"tag":17,"props":2815,"children":2816},{},[2817],{"type":21,"value":1343},{"type":16,"tag":139,"props":2819,"children":2820},{"code":1346,"language":1115,"meta":7,"className":1116,"style":7},[2821],{"type":16,"tag":72,"props":2822,"children":2823},{"__ignoreMap":7},[2824,2839,2878,2909,2916,2939,2950,2961,2972,2979,2986,2993],{"type":16,"tag":228,"props":2825,"children":2826},{"class":230,"line":231},[2827,2831,2835],{"type":16,"tag":228,"props":2828,"children":2829},{"style":262},[2830],{"type":21,"value":1128},{"type":16,"tag":228,"props":2832,"children":2833},{"style":235},[2834],{"type":21,"value":1362},{"type":16,"tag":228,"props":2836,"children":2837},{"style":247},[2838],{"type":21,"value":1367},{"type":16,"tag":228,"props":2840,"children":2841},{"class":230,"line":253},[2842,2846,2850,2854,2858,2862,2866,2870,2874],{"type":16,"tag":228,"props":2843,"children":2844},{"style":247},[2845],{"type":21,"value":1375},{"type":16,"tag":228,"props":2847,"children":2848},{"style":262},[2849],{"type":21,"value":846},{"type":16,"tag":228,"props":2851,"children":2852},{"style":247},[2853],{"type":21,"value":1384},{"type":16,"tag":228,"props":2855,"children":2856},{"style":268},[2857],{"type":21,"value":1389},{"type":16,"tag":228,"props":2859,"children":2860},{"style":247},[2861],{"type":21,"value":1394},{"type":16,"tag":228,"props":2863,"children":2864},{"style":268},[2865],{"type":21,"value":1399},{"type":16,"tag":228,"props":2867,"children":2868},{"style":247},[2869],{"type":21,"value":1404},{"type":16,"tag":228,"props":2871,"children":2872},{"style":262},[2873],{"type":21,"value":1409},{"type":16,"tag":228,"props":2875,"children":2876},{"style":247},[2877],{"type":21,"value":1414},{"type":16,"tag":228,"props":2879,"children":2880},{"class":230,"line":274},[2881,2885,2889,2893,2897,2901,2905],{"type":16,"tag":228,"props":2882,"children":2883},{"style":247},[2884],{"type":21,"value":1422},{"type":16,"tag":228,"props":2886,"children":2887},{"style":262},[2888],{"type":21,"value":846},{"type":16,"tag":228,"props":2890,"children":2891},{"style":247},[2892],{"type":21,"value":1431},{"type":16,"tag":228,"props":2894,"children":2895},{"style":268},[2896],{"type":21,"value":1436},{"type":16,"tag":228,"props":2898,"children":2899},{"style":247},[2900],{"type":21,"value":721},{"type":16,"tag":228,"props":2902,"children":2903},{"style":268},[2904],{"type":21,"value":1445},{"type":16,"tag":228,"props":2906,"children":2907},{"style":247},[2908],{"type":21,"value":1450},{"type":16,"tag":228,"props":2910,"children":2911},{"class":230,"line":284},[2912],{"type":16,"tag":228,"props":2913,"children":2914},{"emptyLinePlaceholder":278},[2915],{"type":21,"value":281},{"type":16,"tag":228,"props":2917,"children":2918},{"class":230,"line":303},[2919,2923,2927,2931,2935],{"type":16,"tag":228,"props":2920,"children":2921},{"style":247},[2922],{"type":21,"value":1465},{"type":16,"tag":228,"props":2924,"children":2925},{"style":268},[2926],{"type":21,"value":1470},{"type":16,"tag":228,"props":2928,"children":2929},{"style":247},[2930],{"type":21,"value":1475},{"type":16,"tag":228,"props":2932,"children":2933},{"style":262},[2934],{"type":21,"value":846},{"type":16,"tag":228,"props":2936,"children":2937},{"style":247},[2938],{"type":21,"value":250},{"type":16,"tag":228,"props":2940,"children":2941},{"class":230,"line":321},[2942,2946],{"type":16,"tag":228,"props":2943,"children":2944},{"style":268},[2945],{"type":21,"value":1491},{"type":16,"tag":228,"props":2947,"children":2948},{"style":247},[2949],{"type":21,"value":1496},{"type":16,"tag":228,"props":2951,"children":2952},{"class":230,"line":329},[2953,2957],{"type":16,"tag":228,"props":2954,"children":2955},{"style":268},[2956],{"type":21,"value":1504},{"type":16,"tag":228,"props":2958,"children":2959},{"style":247},[2960],{"type":21,"value":1496},{"type":16,"tag":228,"props":2962,"children":2963},{"class":230,"line":357},[2964,2968],{"type":16,"tag":228,"props":2965,"children":2966},{"style":268},[2967],{"type":21,"value":1516},{"type":16,"tag":228,"props":2969,"children":2970},{"style":247},[2971],{"type":21,"value":1521},{"type":16,"tag":228,"props":2973,"children":2974},{"class":230,"line":384},[2975],{"type":16,"tag":228,"props":2976,"children":2977},{"style":247},[2978],{"type":21,"value":1529},{"type":16,"tag":228,"props":2980,"children":2981},{"class":230,"line":578},[2982],{"type":16,"tag":228,"props":2983,"children":2984},{"style":247},[2985],{"type":21,"value":1537},{"type":16,"tag":228,"props":2987,"children":2988},{"class":230,"line":596},[2989],{"type":16,"tag":228,"props":2990,"children":2991},{"style":247},[2992],{"type":21,"value":652},{"type":16,"tag":228,"props":2994,"children":2995},{"class":230,"line":615},[2996,3000],{"type":16,"tag":228,"props":2997,"children":2998},{"style":262},[2999],{"type":21,"value":1294},{"type":16,"tag":228,"props":3001,"children":3002},{"style":247},[3003],{"type":21,"value":1556},{"type":16,"tag":17,"props":3005,"children":3006},{},[3007,3008,3013],{"type":21,"value":1561},{"type":16,"tag":72,"props":3009,"children":3011},{"className":3010},[],[3012],{"type":21,"value":85},{"type":21,"value":1568},{"type":16,"tag":60,"props":3015,"children":3016},{"id":1571},[3017],{"type":21,"value":1574},{"type":16,"tag":17,"props":3019,"children":3020},{},[3021],{"type":21,"value":1579},{"type":16,"tag":17,"props":3023,"children":3024},{},[3025],{"type":21,"value":1584},{"type":16,"tag":101,"props":3027,"children":3028},{},[3029,3043,3051,3059,3067,3075],{"type":16,"tag":105,"props":3030,"children":3031},{},[3032,3036,3037,3042],{"type":16,"tag":42,"props":3033,"children":3034},{},[3035],{"type":21,"value":1595},{"type":21,"value":1597},{"type":16,"tag":72,"props":3038,"children":3040},{"className":3039},[],[3041],{"type":21,"value":85},{"type":21,"value":1604},{"type":16,"tag":105,"props":3044,"children":3045},{},[3046,3050],{"type":16,"tag":42,"props":3047,"children":3048},{},[3049],{"type":21,"value":1612},{"type":21,"value":1614},{"type":16,"tag":105,"props":3052,"children":3053},{},[3054,3058],{"type":16,"tag":42,"props":3055,"children":3056},{},[3057],{"type":21,"value":1622},{"type":21,"value":1624},{"type":16,"tag":105,"props":3060,"children":3061},{},[3062,3066],{"type":16,"tag":42,"props":3063,"children":3064},{},[3065],{"type":21,"value":1632},{"type":21,"value":1634},{"type":16,"tag":105,"props":3068,"children":3069},{},[3070,3074],{"type":16,"tag":42,"props":3071,"children":3072},{},[3073],{"type":21,"value":1642},{"type":21,"value":1644},{"type":16,"tag":105,"props":3076,"children":3077},{},[3078,3082],{"type":16,"tag":42,"props":3079,"children":3080},{},[3081],{"type":21,"value":1652},{"type":21,"value":1654},{"type":16,"tag":17,"props":3084,"children":3085},{},[3086,3087,3091],{"type":21,"value":1659},{"type":16,"tag":24,"props":3088,"children":3089},{},[3090],{"type":21,"value":1664},{"type":21,"value":1666},{"type":16,"tag":60,"props":3093,"children":3094},{"id":1669},[3095],{"type":21,"value":1672},{"type":16,"tag":17,"props":3097,"children":3098},{},[3099,3100,3104],{"type":21,"value":1677},{"type":16,"tag":42,"props":3101,"children":3102},{},[3103],{"type":21,"value":1682},{"type":21,"value":1684},{"type":16,"tag":17,"props":3106,"children":3107},{},[3108],{"type":21,"value":1689},{"type":16,"tag":1691,"props":3110,"children":3111},{},[3112],{"type":21,"value":1695},{"title":7,"searchDepth":253,"depth":253,"links":3114},[3115,3116,3117,3123,3124],{"id":62,"depth":253,"text":65},{"id":134,"depth":253,"text":137},{"id":398,"depth":253,"text":401,"children":3118},[3119,3120,3121,3122],{"id":410,"depth":274,"text":413},{"id":671,"depth":274,"text":1704},{"id":949,"depth":274,"text":952},{"id":1077,"depth":274,"text":1080},{"id":1571,"depth":253,"text":1574},{"id":1669,"depth":253,"text":1672},1790205416596]