This document discusses user identity and authentication options for mobile apps using Amazon Web Services. It describes Amazon Cognito user pools, which allow developers to easily add user sign-up, sign-in, and account management to mobile or web apps without having to build their own user directories. Cognito user pools support features like multi-factor authentication, extensive user profile management and permissions. The document also discusses using Cognito user pools with AWS SDKs for user authentication and accessing backend AWS services through Cognito identity pools.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
User Identity and Authentication
Dennis Hills
Developer Advocate / AWS Mobile
Twitter: @dmennis
Email: denhills@amazon.com

2. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Identity is mission critical for applications
Authentication User ManagementAuthorization
§ Manage user lifecycles
§ Store and manage user
profile data
§ Monitor engagement
§ Protect data and
operations
§ Provide fine-grained
access control
§ Sign in users
§ Enable federation with
enterprise identities
§ Enable federation with
social identities
User Identity

3. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon Cognito User Pools
Add user sign-up and sign-
in easily to your mobile and
web apps without worrying
about server infrastructure
Serverless Authentication
and User Management
Verify phone numbers and
email addresses and offer
multi-factor authentication
Enhanced Security
Features
Launch a simple, secure,
low-cost, and fully managed
service to create and
maintain a user directory
that scales to 100s of
millions of users
Managed User Directory
1 2 3

4. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Comprehensive User Flows
Email or Phone Number
Verification
Forgot Password
User Sign-Up and Sign-In
Require users to verify their email address or phone number prior to activating their
account with a one-time password challenge
Provide users the ability to change their password when they forget it with a one-time
password challenge
Allow users to sign up and sign in using an email, phone number, or username (and
password) for your application.
User Profile Data Enable users to view and update their profile data – including custom attributes
SMS Multifactor
Authentication
Require users to complete a second factor of authentication by inputting a security
code received via SMS as part of the sign-in flow
Customize these User Flows Using Lambda
Token Based
Authentication
Use JSON Web Tokens (JWTs) based on OpenID Connect (OIDC) and OAuth 2.0
standards for user authentication in your backend

5. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Extensive Admin Capabilities
Define Custom Attributes
Set per-App Permissions
Set up Password Policies
Create and manage
User Pools
Define custom attributes for your user profiles
Set read and write permissions for each user attribute on a per-app basis
Enforce password policies like minimum length and requirement of certain types
of characters
Create, configure, and delete multiple user pools across AWS regions
Require Submission of
Attribute Data
Select which attributes must be provided by the user prior to completion of the
sign-up process
Search Users
Search users based on a full match or a prefix match of their attributes through
the console or Admin API
Manage Users
Conduct admin actions, such as reset user password, confirm user, enable MFA,
delete user, and global sign-out

6. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Mobile SDK for Identity
• Native UI Components for iOS and Android
– iOS Storyboard
– Android Activity
• Sign-up / Sign-in Flow with Verification
• Multi-factor Authentication
• Add Google & Facebook Authentication

7. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Cognito User Pool as a Standalone IdP
Username
Password
Sign In
Cognito User
Pool
CUP
Token
Backend
resources
Authenticate with a user
pool via our SDK or
hosted UI (beta)
Access backend
resources
• Cognito User Pools can be
used as standalone IdPs
• User Pools provide OpenID
Connect and OAuth2.0
standard tokens that can be
used for authorizing access
to your APIs / backend CUP
Token
API GW
1
2
3

8. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Business to Consumer
Sign in with
Facebook
Or
Username
Password
Sign In
FB Token
Cognito User
Pool
CUP
Token
Exchange user tokens
for AWS credentials tied
to an IAM role
Cognito
Identity Pool
CUP/FB
Token
Authenticate with a user
pool via our SDK
DynamoDB
S3
API GW
Access backend
resources
1b
1a
2
3
• User Pools provide a
directory for users to
sign up and sign in
• Identity Pools provide
AWS credentials to
access backend
resources
Authenticate with
Facebook via their
SDK

9. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Demonstration Time!
Amazon Cognito and AWS Mobile

10. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
© 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved
aws.amazon.com/mobile
Everything you need to connect
Your mobile app to the cloud