Knowing Cognito

Knowing Cognito

Amazon Cognito has both user pools and identity pools. Both solve two different problems and can be used separately or together. In this talk, Cloudar provides an overview of pools and what you should be aware of when looking at the documentation. Learn when you need one or the other, how you can use them together, and how they integrate with other AWS services.

456d636250db8f84291272cc63d508b7?s=128

Ben Bridts

July 11, 2019
Tweet

Transcript

  1. 2.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Knowing Cognito Getting your feet wet with User Pools and Identity Pools Ben Bridts APN Ambassador Cloudar D E V 1 2
  2. 3.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
  3. 4.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T ?
  4. 5.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
  5. 6.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
  6. 7.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
  7. 8.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User
  8. 9.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T User Pools
  9. 10.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Features Users and Groups Sign in Federation Sign up Web UI Customization (UI + Lambda) Advanced Security MFA Credential check Adaptive Authentication Verification (phone + email) this talk
  10. 11.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Login Flows SDK ADMIN_NO_SRP_AUTH USER_SRP_AUTH REFRESH_TOKEN(_AUTH) CUSTOM_AUTH USER_PASSWORD_AUTH OAuth/OIDC Authorization Code Grant Implicit Grant Client Credentials this talk this talk
  11. 15.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T AWS Amplify
  12. 16.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T User Pools: USER_SRP_AUTH Amazon Cognito User Pool Client Mobile client Application Identity Credentials User
  13. 17.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Tokens Access Token: OAuth2 Refresh Token: OAuth2 ID Token: OpenID Connect (OIDC) { "sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "aud": "xxxxxxxxxxxxexample", "email_verified": true, "token_use": "id", "auth_time": 1500009400, "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example", "cognito:username": "janedoe", "exp": 1500013000, "given_name": "Jane", "iat": 1500009400, "email": "janedoe@example.com" }
  14. 18.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
  15. 19.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User Credentials
  16. 20.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User Credentials Mobile client Identity Amazon Cognito User Pool User Credentials
  17. 23.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool User Credentials Code Code Code Amazon Cognito User Pool User
  18. 24.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Authorization (Code) Flow 1. è GET https://domain/oauth2/authorize? client_id=client-abc& redirect_uri=https://myapp.tld/code& scope=openid& response_type=code 2. ç 302 https://myapp.tld/code?code=abcde 1. è POST https://domain/oauth2/token grant_type=authorization_code code=abcde client_id=client-abc client_secret=cba-tneilc redirect_uri=https://myapp.tld/ 2. ç Tokens User Client
  19. 25.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
  20. 26.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials Amazon API Gateway Identity Content Mobile client Access User
  21. 29.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials Amazon API Gateway Content Mobile client Access Access User
  22. 33.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Authorization (Code) Flow 1. è GET https://domain/oauth2/authorize? client_id=client-abc& redirect_uri=https://myapp.tld/code& scope=openid protected-api/api.read& response_type=code 2. ç 302 https://myapp.tld/code?code=abcde 1. è POST https://domain/oauth2/token grant_type=authorization_code code=abcde client_id=client-abc client_secret=cba-tneilc redirect_uri=https://myapp.tld/ 2. ç Tokens User Client
  23. 34.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Other integrations ALB: follows flow for you DIY: validate JWT
  24. 35.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
  25. 36.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
  26. 37.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Identity Pools
  27. 38.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Amazon Cognito Identity Pool Amazon API Gateway Content Mobile client Identity Temporary security credential Credential
  28. 42.
  29. 43.
  30. 44.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
  31. 45.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Federation
  32. 46.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Where? UserPool: - You can merge identities - Can be used without federation - Select provider with /oauth/authorize url, or let user choose with /login IdentityPool: - Only pay for one pool - Only IAM
  33. 49.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Overview
  34. 50.

    Amazon Cognito User Pool Amazon Cognito Identity Pool Identity Provider

    Identity Amazon API Gateway Application Load Balancer Amazon DynamoDB Amazon Simple Storage Service (S3) DIY Access Code Flow Identity Access Identity Access Temporary security credential Temporary security credential Temporary security credential Identity User
  35. 51.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
  36. 52.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Ben Bridts ben@cloudar.be @benbridts speakerdeck.com/benbridts
  37. 53.

    © 2019, Amazon Web Services, Inc. or its affiliates. All

    rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Photos • Pineapple Supply Co • Tinh Khuong • Estonian Saunas • chuttersnap • James Lee • Jesper Stechmann