Welcome back to Backspace Academy. In this lecture on the AWS Cognito 2
authentication service, we'll start off by talking about the Cognito user pools 3
and how we can use those to create millions of users to access our 4
applications that are running on AWS. We'll talk about the Cognito federated 5
ID pools and how we can use a third-party authentication service such 6
as login with Google or log in with Facebook or a SAML authentication 7
service to again authenticate and access our applications on AWS. We'll talk about 8
the Cognito Sync key store database and how we can store data specific for a 9
Cognito user. We'll talk about how Cognito opens up a whole new world of 10
modern serverless applications that we can run completely without servers on AWS 11
and finally we'll talk about troubleshooting and what to do when 12
things go wrong. Cognito it adds user signup sign in and access control for 13
your web and mobile applications. So you might have an application that has 14
millions of users and Cognito can manage all that for you and, those users will 15
have a username and password to access your application. You can also use a 16
social identity third-party OAuth provider for the authentication and 17
integrate that with Cognito such as Facebook Google or Amazon or you could 18
also use a third-party enterprise identity provider and use that via SAML 19
Cognito it consists of three services. The user pools which can have millions 20
of users. Federated identity pools to allow that third-party authentication 21
through OAuth providers or SAML to applications and also a Cognito sync key 22
store database that allows you to store information on specific users. 23
Okay, so on the left there we've got the different ways in which Cognito can 24
authenticate any users that want access to our application. So we've got social 25
identity OAuth provider such as Google, 26
login with Facebook, login with Amazon any of those will be fine. 27
We can set up a Cognito user pool which will have a list of a pool of users and 28
they can login using a username and password and finally, we can use an 29
enterprise identity authentication service provided it is SAML compliant. 30
Once that's done a token will be issued by the Cognito or actually be issued by 31
the STS service, security token service, and we'll talk about that in the next slide 32
and that will allow your users to access through your application 33
AWS resources such as Amazon S3, your API's. You could set up an API Gateway service 34
and they could access that as well, securely. Also you can set up a data 35
synchronization service using Cognito sync, which will be a key store database 36
which will hold data or information on your particular users. The security token 37
service or STS for short is a back-end service that provides that security the 38
low-level security around the IAM service. So it's a back-end service and 39
it's accessible from the software development kit or the command-line 40
interface but it's not accessible through the console. So if you go to the 41
management console and you try and find security token service on the list of services 42
you won't find it, it's just a back-end service that provides the 43
nuts-and-bolts to achieve the security of IAM. So it does that by issuing 44
temporary limited privilege credentials for IAM or federated users for example 45
if you're using login with Facebook or login with Google or a SAML Enterprise 46
authentication service. They will be limited privileged credentials. 47
It achieves this by using JSON web tokens or JWT for short and, 48
it uses those to secure and authorize the access to your API such as an API gateway 49
service or other AWS services such as Amazon s3 and, those web tokens there 50
will be temporary and, they will have limitations on how that, 51
your user can access your account, for example if it's a root user it will have full 52
access to your account. If it's someone who's validated through an 53
authentication service such as logging of Google they may have the access 54
specifically for read-only not write and it will be only to a certain part of 55
your application or a certain part of that service such as s3. It's a global service 56
like IAM and the endpoint for it is STS.amazonAWS.com and 57
it integrates very well with Cloudtrail. So if you want to see an audit trail of 58
users that have been issued an STS token then you can see that by setting 59
up a cloudtrail log. Ok, so here we have a mobile application and it's going to 60
be using the third-party login with Amazon service to authenticate that 61
mobile user but, that could also be login with Facebook or, it could be login with PayPal 62
it could also be a Cognito User Pool that we could log in with 63
a username and password but whatever it is, it's a service that we use to 64
authenticate this individual. So once we have authenticated using that third 65
party service, login with Amazon will hand over a token to that mobile client 66
and that mobile client will then pass that token over to the AWS security 67
token service and the AWS STS service will then go back to the login with 68
Amazon service to authenticate that token. If that token is valid for that 69
particular user then the STS service creates an AWS temporary JWT a JSON web token 70
and passes that back to the mobile client. Once a mobile client has that, 71
they have limited and temporary access to AWS resources and those AWS resources will 72
be defined in an IAM policy. So if that mobile client has read-only access then 73
that will be defined in the IAM policy. If that mobile client or that end-user 74
only has access to a specific part of that database then they will only be 75
granted access to that specific part. So in this situation they're being given 76
read and write access to the game score. So they've got a high score 77
the mobile application can write that back to Dynamodb and it's completely 78
secure and completely straightforward because we're using this STS service to 79
manage everything for us. 80
Cognito user pools allow us to create and maintain a directory of our users 81
and that could be millions of users, it could be 10 users, or could be anything 82
but it scales to hundreds of millions of users and those 83
users will simply be authenticated by signing up and then signing in for your 84
applications. When it is associated with a Cognito ID pool it can provide secure 85
access to your AWS resources. So you may have an application that requires access 86
to some images on Amazon S3. So if that person signs in to a Cognito User Pool 87
and they're on that user pool, then they will be granted specific access to 88
that s3 bucket, depending on what is written into that IAM policy that 89
defines all this. Web identity federation pools they allow you to create unique 90
identifiers for your end users and those will be kept consistent across 91
your devices and platforms. So if you log in with a different device it will be 92
using the same unique identifier depending on despite what device or 93
platform your login. If you login with Mac and then windows or if you login on 94
a mobile device, it will still authenticate you as that unique identifier. 95
So the users can use an identity provider such as Facebook to 96
log in and then they will attain security token service or STS temporary 97
credentials. Now one thing I need to say about this is that before Cognito came 98
along and still now is the case, that you don't need to have Amazon 99
Cognito to have federated access to AWS resources. Where the Cognito Federation 100
pools come in or, identity Federation pools come in, is that they will link 101
that login to a specific Cognito identifier and that can be used with 102
Cognito user pools or a Cognito sync database as well as for temporary access 103
to AWS resources. So if we just wanted to have the access to AWS resources 104
such as an amazon s3 bucket, then you can actually do a federated login using 105
Google and using the STS service on its own, but you won't have all of the other 106
features of integrating with Cognito. 107
Okay so here we've got a one example of how we can use the Federated ID process 108
So we've got a device here and it has an application running on us on it that 109
uses the one of the AWS software development kits and we use log in with 110
Facebook for example and so once we've logged in using that OAUTH process 111
to login to Facebook, Facebook will give us details of or will give our 112
application the details of that user such as their account ID for Facebook or 113
whatever it is and also a security token for Facebook as well. 114
Once we've got that information we can then use get ID with Amazon Cognito do a 115
call to Amazon Cognito to get the Amazon Cognito ID of that person that is 116
logging in with that Facebook account. Once we've got that we can then get the 117
credentials for that Cognito ID and and get that from the AWS STS service 118
So we will grab that Facebook token. We will grab the Amazon Cognito ID details and, 119
we will pass it over to Cognito which will then also pass it over to the AWS 120
security token service and from there, we will be issued or your application 121
running on that device will be issued with a temporary AWS STS JSON web token 122
and from there we use that token to access or have limited access to our AWS 123
resources. The difference being to the last process that we saw is that we've 124
got Amazon Cognito here as well, so we can also now with that Cognito ID, 125
access a Cognito sync database or a Cognito user pool as well. Cognito sync is a key 126
store database that provides cross device syncing of all of your 127
application related user data and that will be synchronized across your 128
multiple devices, multiple platforms, be it windows or mac or whatever and 129
it also has offline storage. So if you if your internet connection gets cut 130
you will still have access to that user data. There are two ways of 131
achieving or accessing this sync key store database. The first one is to use 132
the Cognito sync manager JavaScript SDK. So that's another SDK that you will need 133
to load into your your JavaScript application and there is a synchronize 134
command and what that will do, it will update the records on the keystore 135
database on the server side and, it will synchronize it with browser local storage 136
on the device side. Now before the Sync manager came along the 137
way we did it is that we would do that manually. So we would use the JavaScript 138
SDK which is another way and use the update records command to update the 139
records on the keystore database and also to create records if there is no 140
record there and then we would manually use the browser local storage to secure 141
that in local storage on your browser, but either way both work but 142
one of them requires an additional SDK to be loaded into your application which 143
may reduce the startup time for your application in the browser, so something 144
to take into consideration, but certainly the Sync manager is a quick and easy way 145
of doing it. A great thing about using Cognito is that it opens up a world of 146
really powerful serverless single page applications that are very reactive, 147
provide very quick feedback to your end-users and use very limited resources 148
because they're shifting a lot of those resources that you would normally have 149
on the server side over to the client side. So looking at this example here 150
we've got a desktop or mobile application and it's a ReactJS application. 151
So it's going to be a single page application a bit like your Gmail 152
app in your browser. So it's not going to be doing page refreshes. So anything that 153
needs to be updated will be updated individually based on what what the 154
latest information that application is getting and only those components of 155
that user interface will be updated. So that's going to provide some 156
really good speed for your application it's also going to shift that work that 157
would normally be done on the server side over to the client side and that's 158
going to save you a lot of money. So we already know how to create a single page 159
application on uploading it to Amazon s3 and using Amazon s3 web hosting and 160
fronting that with Cloudfront. So we already know how to do that but in our 161
application we can make calls to Cognito federated ID, we can use a Cognito user 162
pool or we can use a SAML or OAuth authentication service and that will 163
allow us to access a Cognito user pool which will keep details on our users. 164
So that's a great authentication service that is very quick and easy to 165
set up and you don't have to do that yourself. Now let's say that we want this 166
end-user to be able to access some data from a DynamoDB database and let's also 167
say that because ReactJS from Facebook goes hand in hand with 168
GraphQL which was also developed by Facebook. We might want to have a GraphQL 169
client running on our application. Now if you don't know what GraphQL is just 170
Google it because it's another way of thinking about data and it is certainly 171
revolutionizing the way that we think about integration of data with our 172
applications so certainly go and Google that and if you are a developer make 173
sure you know GraphQL because it's going to be here to stay. 174
So once we've got our client set up they can issue GraphQL queries to AWS 175
we can set up AWS Appsync which is a GraphQL server and it will provide the glue 176
between our application and our back-end database and that will be completely 177
serverless. So here all of a sudden we've got a ReactJS front end, we've got GraphQL 178
on the client side as a GraphQL client and we've also got federated 179
identity access to a GraphQL server which will also integrate nicely with 180
Amazon DynamoDB. We don't have to write any sort of interface between 181
Appsync and DynamoDB it simply connects directly to DynamoDB 182
If that DynamoDB database is very popular we can also have a DynamoDB accelerator 183
which is a cache of our regularly accessed content in a similar way to 184
cloudfront as a cache for S3. Now let's just say we want to 185
have ecommerce capabilities for our application, and so to do that we're 186
going to use the PayPal API. So we need some way of communicating with a PayPal 187
API and organizing those payments and at the same time updating our database with 188
those payment details and, what it was actually paid for. So the way we can do 189
that is that we could implement a Lambda function and so that could communicate 190
with PayPal API so that whenever a payment is made by a user that is using 191
this application the PayPal API will notify that Lambda function but 192
will call an endpoint that will trigger that Lambda function and then that Lambda 193
function can go back to the Cognito ID service, identify that user and then 194
update the Dynamodb table with the payment details for that end user. 195
Okay, so let's have a look at some troubleshooting steps that we can look 196
at in case we run into some problems. The first one there is if we're hosting our 197
website on Amazon s3 or using an Amazon s3 bucket and the web hosting service of S3, 198
we need to make sure that we establish cross-origin resource sharing 199
or CORS on that bucket otherwise any calls from the application that's 200
running on that s3 bucket or running on the clients browser, they will 201
not be allowed by the browser to access that endpoint for Cognito 202
So you need to make sure that cross-origin resource sharing is set up otherwise 203
you're not going to be able to access Cognito. You need to make sure that 204
you've got an IAM role set up for Cognito ID and that there is an allow rule 205
that allows anyone that assumes that role through a Cognito, that they 206
have access to that resource, be it for example Dynamodb. So if you're finding 207
that you're not going to be or you're not able to access that resource after 208
signing in, make sure that you check that IAM role and make sure that there is an 209
allow for that service. Now when you set up Cognito ID you need to establish or 210
define a trust relationship between the Cognito service and that other service 211
that you're using to authenticate so if you're going to be using an OAuth 212
service such as Facebook or you're going to be using a Cognito user pool to 213
authenticate those people or you you might be using a SAML enterprise 214
service, you need to define that when you're setting up Cognito ID, and that 215
will allow that trust relationship to be set up by Cognito. Finally you need to 216
make sure that you're using the correct software development kit for the code. 217
So there are multiple JavaScript SDKs for this Cognito services, ones for the sync 218
manager, there's one just specifically for the low-level stuff with the SDK 219
there's a whole heap of them and you need to make sure that you're using the 220
right one. So you'll probably start off with the JavaScript SDK 221
and then you may add the Cognito sync manager SDK to that as well, but you just 222
need to make sure that, if you're going to be using those commands, that you have 223
loaded the SDK into your application before you start using those commands. 224
So that brings us to the end of a very broad overview of the Cognito service 225
and I look forward to seeing you in the next one.