- Understand user identity and federation principles and practices - Learn how Amazon Cognito works with federated identity providers - See how to use Amazon Cognito to add the forms for user Sign-up and Sign-in to an application

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tim Hunt, Sr. Product Manager, Amazon Cognito
September 12, 2017
Deep Dive on User Sign-up
and Sign-in with Amazon
Cognito

2. Topics
 AWS Mobile Services and Amazon Cognito
 Introduction to Amazon Cognito User Pools
 Summary of Features
 Demo
 Sample Use Cases
 Getting Started
 Q & A

3. Authenticate users
Analyze User Behavior
Store and share media
Synchronize data
Deliver media
Amazon Cognito
(Sync)
Amazon Cognito
(Identity)
Amazon S3
Amazon CloudFront
Store data
Amazon DynamoDB
Amazon RDS
Run Targeted Campaigns
Send push notifications
Amazon SNS
Mobile Push
Server-side logic
Lambda
Device Farm
Test your app
Build and Scale Your Apps on AWS
Amazon Pinpoint
Amazon Pinpoint

4. AWS Mobile Hub: Fastest Way to Build Apps on AWS

5. Identity is mission critical for applications
Authentication User ManagementAuthorization
 Manage user lifecycles
 Store and manage
user profile data
 Monitor engagement
 Protect data and
operations
 Provide fine-grained
access control
 Sign in users
 Enable federation with
enterprise identities
 Enable federation with
social identities
User Identity

6. Your User Pools
Add user sign-up and sign-
in easily to your mobile and
web apps without worrying
about server infrastructure
Serverless Authentication
and User Management
Verify phone numbers and
email addresses and offer
multi-factor authentication
Enhanced Security
Features
Launch a simple, secure,
low-cost, and fully managed
service to create and
maintain a user directory
that scales to 100s of
millions of users
Managed User Directory
1 2 3

7. Comprehensive User Flows
Email or Phone
Number Verification
Forgot Password
User Sign-Up and
Sign-In
Require users to verify their email address or phone number prior to activating
their account with a one-time password challenge
Provide users the ability to change their password when they forget it with a one-
time password challenge
Allow users to sign up and sign in using an email, phone number, or username
(and password) for your application.
User Profile Data Enable users to view and update their profile data – including custom attributes
SMS Multifactor
Authentication
Require users to complete a second factor of authentication by inputting a
security code received via SMS as part of the sign-in flow
Customize these User Flows Using Lambda
Token Based
Authentication
Use JSON Web Tokens (JWTs) based on OpenID Connect (OIDC) and OAuth
2.0 standards for user authentication in your backend

8. Custom User Flows Using Lambda Hooks
8
Category Lambda Hook Example Scenarios
Custom
Authentication
Flow
Define Auth Challenge Determines the next challenge in a custom auth flow
Create Auth Challenge Creates a challenge in a custom auth flow
Verify Auth Challenge Response Determines if a response is correct in a custom auth flow
Authentication
Events
Pre Authentication Custom validation to accept or deny the sign-in request
Post Authentication Event logging for custom analytics
Sign-Up
Pre Sign-up Custom validation to accept or deny the sign-up request
Post Confirmation Custom welcome messages or event logging for custom analytics
Messages Custom Message Advanced customization and localization of messages

9. Extensive Admin Capabilities
Define Custom
Attributes
Set per-App
Permissions
Set up Password
Policies
Create and manage
User Pools
Define custom attributes for your user profiles
Set read and write permissions for each user attribute on a per-app basis
Enforce password policies like minimum length and requirement of certain
types of characters
Create, configure, and delete multiple user pools across AWS regions
Require Submission of
Attribute Data
Select which attributes must be provided by the user prior to completion of
the sign-up process
Search Users
Search users based on a full match or a prefix match of their attributes
through the console or Admin API
Manage Users
Conduct admin actions, such as reset user password, confirm user, enable
MFA, delete user, and global sign-out

10. App Integration and Federation in User Pools
Built-in, Customizable
User Interface for Sign up
/ Sign in
OAuth 2.0 SupportFederation with Facebook,
Login with Amazon,
Google, and SAML
providers
1 2 3

11. Built-in, Customizable User Interface
Upload your own
logo and adjust
CSS properties
to fit your style
and branding

12. Federation with Cognito User Pools
• Built-in integrations with identity
providers
• Social: Facebook, Google, Login
with Amazon
• Corporate via SAML 2.0
• Map user attributes into User Pool
profiles
• Universal directory with common
set of profiles and tokens for all
users
CUP
Token
Cognito User Pool

13. Support for OAuth 2.0 in Cognito User Pools
• OAuth 2.0 flows:
• Authorization code
• Implicit
• Client credentials
• Custom scopes defined for resource
servers

14. Cognito Federated Identities (Identity Pools)
• Exchanges tokens from
authenticated users for AWS
credentials to access
resources such as S3 or
DynamoDB
• You can defined rules for
mapping users to different IAM
roles to manage permissions
• Provides an identity pool id to
uniquely identify users
Cognito
Identity Pool
AWS Credentials
/ / etc
token
Mobile or web app
DynamoDB
S3
API GW
Access backend
resources
- tied to IAM role
1
3
2

15. Two Ways to Federate with Amazon Cognito
Cognito User Pools Cognito Identity Pools
• Handles the IdP interactions
for you
• Provides profiles to manage
users
• Provides OpenID Connect and
OAuth2.0 standard tokens
• Priced per monthly active user
• Provides AWS credentials for
accessing resources on behalf
of users
• Supports rules to map users to
different IAM roles
• Free

16. Amazon Cognito for Authentication and Access
Get AWS
credentials
Cognito
Identity PoolDynamoDB S3
Access AWS Services
Federating
IdP
Cognito
User Pool• User Pools authenticate
users and returns standard
tokens
• User Pool tokens are used
to access backend
resources
• Identity Pools provide
AWS credentials to access
AWS services
Authenticate
3
CUP
Token1
IdP
Token
2
Redirect /
Post back
CUP
Token
5
6
Access Serverless BackendCUP
Token
API GW
4
Lambda

17. Demo

18. Amazon Cognito: Identity Management Scenarios
Business to Consumer Business to Business
Business to Employee IoT Scenarios
Enterprise
DirectoryEnterprise
Directory
SAML
Enterprise
Directory
SAML
AWS IoT

19. Amazon Cognito: Authorization Scenarios
Standalone Identity Provider Amazon API Gateway AWS Credentials
Resources
• OIDC and OAuth 2.0 tokens
from User Pools can be used
directly to access backend
resources
CUP
Token
CUP
Token
CUP
Token
CUP
Token
AWS IAM
AWS
Credentials
AWS Services
S3DDBLambda
• User Pool tokens authorize
requests via Amazon API
Gateway
• Token claims can be inspected
• Temporary AWS credentials
provide access to AWS
services
• Users can be mapped to
different roles and policies
API GW

20. Cognito User Pools and Amazon API Gateway
Native Support Custom Authorizer Function
Control access to your APIs using bearer
token authentication strategies, such as
OAuth or SAML – API Gateway’s custom
authorizer feature uses bearer tokens to
determine access privileges
Configure API Gateway to accept ID tokens
to authorize users based on their existence
in a user pool – User Pools works together
with API Gateway to authorize API requests
1 2

21. Getting Started with Your User Pools
See aws.amazon.com/cognito/dev-resources/ for links to
 Getting Started Guides
 Documentation, SDKs, and Sample Apps
 Videos
 Presentation Slides
 Blog Posts
 Developer Forums

22. Q & A
 Visit aws.amazon.com/cognito/ to learn more
 Find resources at aws.amazon.com/cognito/dev-resources/
 Ask questions at the AWS Developer Forum or Stack Overflow
(‘amazon-cognito’ tag)

23. Thank you!

24. Appendix

25. Groups
Cognito User Pools
Groups and Multiple Authenticated Roles
Group A
IAM Role A
Group B
IAM Role B
…
Authenticated
User Identity
Get
Credentials
Multiple Roles for Authenticated Identities
Cognito Federated Identities
IAM Role and Policy
IAM Role and Policy
IAM Role and Policy
Backend
Resources
MaptodifferentIAMroles
API Gateway
DynamoDB
S3
ControlAccess

26. Control Attribute Permissions
Choose which user attributes
each app can read and write
Read Write
name
phone
custom:paid

27. Creating Users as an Administrator
 Developers or administrators can create users in a user pool and
send them an optional, customizable invitation email or SMS message
 New users sign in with a temporary password and create a new
password
 User pools can be configured to only allow users created by an
administrator

28. Importing Existing Users
Batch Imports
 Import users by uploading .csv files
 Users will create a new password when they first sign-in
 Each imported user must have an email address or a
phone number
One-at-a-Time Migration
 Migrate users individually as they sign in
 App first tries to sign in via Cognito, if user does not
exist, app signs in via prior identity system, captures
username and password, and silently creates user in
Cognito
 Retains passwords, but requires app coding and
maintenance of prior system for some period
Prior
IdP

29. Understanding User Status
 New users start with
“Registered” status
 Users must be
confirmed before
they can sign-in
 Users must be
disabled before they
can be deleted
Registered
(cannot sign in)
Sign-up
Confirmed
Disabled
Admin
Confirm
Confirm via
email/phone
or
Disable
Delete
(deleted)
Lambda Trigger:
Pre Sign-up Reset Required
User import
Force Change
Password
Admin Create User
Reset password
Enable

30. Verifying Email and Phone
 Your User Pools provide built-in verification of email
addresses and phone numbers
 A six digit code is sent as an email message or SMS
text and is submitted via the VerifyUserAttribute
API
 If both a phone number and email address are
provided at sign-up, a verification code will only be
sent to the phone
 Your app can call GetUser to see if an email address
or phone number is awaiting verification, and then call
GetUserAttributeVerificationCode to initiate
the verification
Your verification
code is 938764