Add End User Sign-in, User Management, and Security to Your Mobile and Web Applications with Amazon Cognito
•
1 like•568 views
Amazon Cognito provides user authentication, authorization, and user management services for web and mobile applications. It allows adding user sign-up, sign-in and access management without having to build and maintain the backend infrastructure. Cognito supports user sign-in via social identity providers or corporate directories. It also provides multi-factor authentication and integrates with AWS services like API Gateway for authorization. Cognito can scale to support hundreds of millions of users.
Report
Share
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Add End User Sign-in, User Management, and Security to Your Mobile and Web Applications with Amazon Cognito
Similar to Add End User Sign-in, User Management, and Security to Your Mobile and Web Applications with Amazon Cognito (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
Add End User Sign-in, User Management, and Security to Your Mobile and Web Applications with Amazon Cognito
- 1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Add end user sign-in, user management, and security to your mobile and web applications with Amazon Cognito Vikram Madan, Sr. Product Manager
- 2. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Developing Auth Infrastructure for Your App • Need to develop your own user directory to manage your users • Getting security right for both user data and passwords is complicated • Scalability of the app is often an afterthought • Support for multiple social identity providers • Federation with corporate directories for B2E applications 1 2 3 4 2 5
- 3. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Amazon Cognito Identity Federated Identities Your users can sign in through third-party identity providers, such as Facebook, Twitter, and SAML providers, and you can control access to AWS resources from your app. Your User Pools You can easily and securely add sign-up and sign-in functionality to your mobile and web apps with a fully-managed service that scales to support 100s of millions of users.
- 4. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Comprehensive Support for Identity Use Cases
- 5. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Your User Pools Add user sign-up and sign- in easily to your mobile and web apps without worrying about server infrastructure Serverless Authentication and User Management Verify phone numbers and email addresses and offer multi-factor authentication Enhanced Security Features Launch a simple, secure, low-cost, and fully managed service to create and maintain a user directory that scales to 100s of millions of users Managed User Directory 1 2 3
- 6. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Comprehensive User Flows Email or phone number Verification Forgot Password User registration and authentication Users verify their email address or phone number prior to activating an account Users can change their password if they forget it Users can sign up using an email, phone number, or username (and password). From there on, the user can then sign in to the application. User Profile Data User can view and update their profile data – including custom attributes SMS-based MFA Users complete Multi-Factor Authentication (MFA) by inputting a security code received via SMS as part of the sign-in flow Customize these User Flows Using Lambda
- 7. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Custom User Flows Using Lambda Hooks Category Lambda Hook Example Scenarios Authentication Pre Authentication Custom validation to accept or deny the sign-in request Post Authentication Event logging for custom analytics Sign-Up Pre Sign-up Custom validation to accept or deny the sign-up request Post Confirmation Custom welcome messages or event logging for custom analytics Messages Custom Message Advanced customization and localization of messages
- 8. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Custom Auth Flow Cognito User Pools Custom Authentication Challenges (e.g., CAPTCHA or custom 2nd factors) 1 2 5 6 3 4
- 9. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Extensive Admin Capabilities Define Custom Attributes Set per-App Permissions Set up Password Policies Create and manage User Pools Define custom attributes for your user profiles Set read and write permissions for each user attribute on a per-app basis Enforce password policies like minimum length and requirement of certain types of characters Create, configure, and delete multiple user pools across AWS regions Require Submission of Attribute Data Select which attributes must be provided by the user prior to completion of the sign-up process Search Users Search users based on a full match or a prefix match of their attributes through the console or Admin API Manage Users Conduct admin actions, such as reset user password, confirm user, enable MFA, delete user, and global sign-out
- 10. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Remembered Devices Remember the devices associated with your users 1 How do I reduce the friction that my users face when having to complete the 2nd factor challenge on every sign-in? How do I build logic to associate devices with my users to achieve my specific business requirements? 2
- 11. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Importing Existing Users Import users into your Cognito user pool by uploading .csv files Users will create a new password when they first sign-in Each imported user must have an email address or a phone number
- 12. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Cognito User Pools and Amazon API Gateway Custom Authorizer Function Native Support User Pools works together with API Gateway to authorize API requests. You can configure API Gateway to accept ID tokens to authorize users based on their presence in a user pool. You can control access to your APIs using bearer token authentication strategies, such as OAuth or SAML. The custom authorizer uses bearer tokens to determine access privileges. 1 2
- 13. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Cognito Federated Identities – SAML-enabled Enterprise Identities Username Password Sign In SAML Identity Provider Example: ADFS Amazon Cognito Federated Identities 2. Get AWS credentials API Gateway Your APIs
- 14. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Cognito Federated Identities – Social Identities Username Password Sign In Sign in with Facebook Amazon Cognito Federated Identities 2. Get AWS credentials API Gateway Your APIs
- 15. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved Demo
- 16. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved “Building an AWS serverless platform that manages sensitive customer data requires an authentication strategy that protects the information from unauthorized access. Using the Amazon Cognito user pool feature together with AWS Lambda, we’re developing a flexible, fully integrated solution that can scale effortlessly – a powerful tool that will be critical in keeping our customers’ data secure.” Feedback from Our Customers “It is critical for us to provide a secure and simple sign-up and sign-in experience for our tens of millions of end users. With Amazon Cognito, we can enable that without having to worry about building and managing any backend infrastructure.”
- 17. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved aws.amazon.com/activate Everything and Anything Startups Need to Get Started on AWS
Editor's Notes
- Today, we’re first going to dive deep in the new User Pools feature of Cognito. But first taking a step back, Users Pools is part of a broader, comprehensive Identity solution. On one hand, you have User Pools – which we launched GA on July 28th. This enables developers to add sign-up and sign-in to their own application, and underneath is a highly scalable user directory On the other hand, you have Federated Identities, which enables sign-in through third-party identity providers – both social and enterprise – in addition to providing authorization functionality through a role-based access control framework
- Here I want to demonstrate how each of the component pieces come together On the left-hand side, you have authentication – and we can support social identities, enterprise identities, and your own identities through user pools On the right-hand side, you have authorization and data synchronization. You can control access to AWS resources and your own API in addition to synchronizing data across devices through the cloud One important note that I want to highlight here is that this solution is meant for not mobile but also web apps as well – we support a higher-level client-side SDK for JavaScript in addition to externalizing all of the lower level end points through the AWS SDK Now I want to double-click on User Pools
- So there are three high level points to takeaway for User Pools The first is that this solution provides you the user model for your application and also provides user authentication flow in addition to extensive user management capabilities. You can do allow of this without managing server infrastructure. The second is the underlying user direction, which is fully managed service and highly scalable – it can scale to 100’s of millions of user. And third, with this solution we productize many of the security best practices we use at AWS. For example, we enable phone number and email verification in addition to multi-factor authentication.
- The core flows include user registration and authentication. Users can sign up and sign up with a email address, phone number, or username. Also during the user registration process, you can capture rich user profile data – the user can then view and update their profile data You can also gate user registration on verification of either the user’s email or phone number We also provide a flows for forgot password and SMS-based multi-factor authentication
- Lambda is our microserivces framework, which let’s you run code without provisioning or managing servers. And you can use Lambda in conjunction with User Pools to customize the user flow according to your business requirements.