Link a third party application account in Cognito

If I am understanding you correctly - what you need is for the user to log into your application with credentials they have for another application and then store the login they have for that application and provide them with new login details where those login details link them to your application and the that application.

Have a look here: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html

However taking that approach the users will still login with application B details. But Cognito provides that out of the box.

If for some reason you do not want to take that approach - and you want to have a force change on the password you must do the link yourself.

A suggested approach would be as follows (Making use of Lambda Triggers in Cognito User Pools):

Pre-signup lambda trigger:

• Get the user credentials
• Use the credentials to make the call in that lambda function to application B.
• Get the authentication response from that call
• Pass this as a param to your Cognito user attributes
• Make a call using AdminCreateUser(https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html)

Now you have the user stored with the auth data from application B as a custom attribute.

This is not the best way to do it though because auth data usually needs to get refreshed which will add extra complexity. You could do that refresh in a Pre-Authentication Trigger that updates that custom attribute for the user.

Honestly, if application B is custom, I think the best approach for you will be to use OIDC Provider approach https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-oidc-idp.html