Knowing Cognito

Amazon Cognito has both user pools and identity pools. Both solve two different problems and can be used separately or together. In this talk, Cloudar provides an overview of pools and what you should be aware of when looking at the documentation. Learn when you need one or the other, how you can use them together, and how they integrate with other AWS services.

Transcript

1. S U M M I T N E W Y O R K
2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Knowing Cognito Getting your feet wet with User Pools and Identity Pools Ben Bridts APN Ambassador Cloudar D E V 1 2
3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T ?
5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User
9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T User Pools
10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Features Users and Groups Sign in Federation Sign up Web UI Customization (UI + Lambda) Advanced Security MFA Credential check Adaptive Authentication Verification (phone + email) this talk
11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Login Flows SDK ADMIN_NO_SRP_AUTH USER_SRP_AUTH REFRESH_TOKEN(_AUTH) CUSTOM_AUTH USER_PASSWORD_AUTH OAuth/OIDC Authorization Code Grant Implicit Grant Client Credentials this talk this talk
12. Create UserPool Create AppClient Enable Identity Provider
13. Create UserPool Create AppClient Enable Identity Provider
14. Create UserPool Create AppClient Enable Identity Provider
15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T AWS Amplify
16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T User Pools: USER_SRP_AUTH Amazon Cognito User Pool Client Mobile client Application Identity Credentials User
17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Tokens Access Token: OAuth2 Refresh Token: OAuth2 ID Token: OpenID Connect (OIDC) { "sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "aud": "xxxxxxxxxxxxexample", "email_verified": true, "token_use": "id", "auth_time": 1500009400, "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_example", "cognito:username": "janedoe", "exp": 1500013000, "given_name": "Jane", "iat": 1500009400, "email": "janedoe@example.com" }
18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User Credentials
20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials User Credentials Mobile client Identity Amazon Cognito User Pool User Credentials
21. Create Domain Configure AppClient
22. Create Domain Configure AppClient
23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool User Credentials Code Code Code Amazon Cognito User Pool User
24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Authorization (Code) Flow 1. è GET https://domain/oauth2/authorize? client_id=client-abc& redirect_uri=https://myapp.tld/code& scope=openid& response_type=code 2. ç 302 https://myapp.tld/code?code=abcde 1. è POST https://domain/oauth2/token grant_type=authorization_code code=abcde client_id=client-abc client_secret=cba-tneilc redirect_uri=https://myapp.tld/ 2. ç Tokens User Client
25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials Amazon API Gateway Identity Content Mobile client Access User
27. Create Authorizer Configure Method
28. Create Authorizer Configure Method
29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Identity Amazon Cognito User Pool Credentials Amazon API Gateway Content Mobile client Access Access User
30. Create Resource Server Configure AppClient Configure Method
31. Create Resource Server Configure AppClient Configure Method
32. Create Resource Server Configure AppClient Configure Method
33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Authorization (Code) Flow 1. è GET https://domain/oauth2/authorize? client_id=client-abc& redirect_uri=https://myapp.tld/code& scope=openid protected-api/api.read& response_type=code 2. ç 302 https://myapp.tld/code?code=abcde 1. è POST https://domain/oauth2/token grant_type=authorization_code code=abcde client_id=client-abc client_secret=cba-tneilc redirect_uri=https://myapp.tld/ 2. ç Tokens User Client
34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Other integrations ALB: follows flow for you DIY: validate JWT
35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Identity Pools
38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Mobile client Amazon Cognito Identity Pool Amazon API Gateway Content Mobile client Identity Temporary security credential Credential
39. Create IdentityPool Configure Provider Configure Roles
40. Create IdentityPool Configure Provider Configure Roles
41. Create IdentityPool Configure Provider Configure Roles
44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Our employees should be able to call our API after logging in with Active Directory
45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Federation
46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Where? UserPool: - You can merge identities - Can be used without federation - Select provider with /oauth/authorize url, or let user choose with /login IdentityPool: - Only pay for one pool - Only IAM
47. Configure SAML Set Up Federation Configure App Client
48. Configure SAML Set Up Federation Configure App Client
49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Overview
50. Amazon Cognito User Pool Amazon Cognito Identity Pool Identity Provider Identity Amazon API Gateway Application Load Balancer Amazon DynamoDB Amazon Simple Storage Service (S3) DIY Access Code Flow Identity Access Identity Access Temporary security credential Temporary security credential Temporary security credential Identity User
51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Amazon Cognito User Pools Identity Pools AKA Cognito Identity Provider Cognito Federated Identities API cognito-idp cognito-identity Provides Authentication User Management Authorization (to AWS APIs) Think OpenID Provider STS Token Endpoint User Objects Stored in the pool Federated Unauthenticated Federated
52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. Ben Bridts ben@cloudar.be @benbridts speakerdeck.com/benbridts
53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. © 2019, Cloudar BVBA. All rights reserved. S U M M I T Photos • Pineapple Supply Co • Tinh Khuong • Estonian Saunas • chuttersnap • James Lee • Jesper Stechmann