Amaon cognito
Published: 2023-04-15 09:17:52

**What does Cognito?**
Give users an identity to interact with web or mobile application
**Cognito user pools:**
- sign in functionality for all users
- integrate with API gateway & application load balancer

**Cognito identity pools(Federated Identity):**
- provides temporary AWS credentials to users so they can access AWS resources directly
- integrate with cognito user pools as an identity provider

**Features:**
- create a serverless database of user for your web and mobile apps
- simple login:username(or email)/password combination
- password reset
- Email and phone number verification
- MFA
- federated identities: users from facebook,google,SAML
- feature:block users if credentials are compromised elsewhere
- login sends back a JSON Web Token(JWT)
Daigram:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3wgepfw6fhq0v1cdk50f.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pt54dtjzclbpjdi5yret.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tr1o1o6xbzo8mpj8g3l6.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9y8e610v92lfnl8wrb0p.png)

choosing to create a user pool
Authentication can be done in 2 ways
1. cognito user pool(username &password, email)
2. federation identity providers(google,facebook,SAML)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r3ratx842ywb2vsvybn1.png)


password can be default or customied


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kcnzluo6ibjf0sd01yev.png)
Multi factor Authentication can be chosen whether it should be mandatory, option or not required


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oxgy612eb21ytiboleud.png)

account recovery can be enable or diable
if enable, in which way we can recover through forgot password can be chosen

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/namw4uwmveyl5tjs9tjd.png)

enabling new users to register for your app(enable self registartion)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ubq0dwer8x8k90otwv10.png)
verification

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fe6yhsysn2lvhyoigd6l.png)
we can add the reuired attributes to the signup page(if reuired)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/20x1vp1fr218txj58vky.png)


if any other custom attributes needs to be added we can

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/da5p7vn97cqmo9w5rcfd.png)

configure how user pool sends message to users

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0kqpu3q5wzylxz8dy1l2.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h7iw78cru9e20ctll19d.png)
call back urls can be specified after successful login

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/72mhxvfw6l6j9v6mrgnu.png)
can review once and can be created


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b8u16i0zg4hhfw0m4ia8.png)

In sign in experience tab if required can add identity provider

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mei7bpzidd0j15b4xw9v.png)
click on view hosted to create a user

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7ybzc5ege0ahvswyewdc.png)

this will open the login page in new tab once sign up with the page sends verification SMS to the registered mail. after successful login, navigate to the call back url page

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ehyikjk5bce38fodokh2.png)

we can specify lambda triggers for any of the functionality


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h3w3gkebly4lcd76d3n2.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u84qdt6rm2qk3ouk1fvg.png)

**cognito user pools - lambda triggers**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d01r9nac9uo2qdwi0uyb.png)

**Hosted Authentication UI**

- cognito has hosted authentication UI that can be add to your own app to handle signup and sign in workflows
- using the hosted ui, your app can integrate with social login, OIDC or SAML
- can be customised with custom logo and custom CSS 

**Hosted UI custom domain**

- for custom domains you must create ACM certificate(us-east-1)
- custom domain is defined in app integration section

**JSON Web Token(JWT)**

- CUP issues JWT tokens
  - headers
  - paload
  - signature
- the signature can be verified  to ensure the JWT token can be trusted

**Application Load Balancer - Authenticate users**
your application load balancer can securely authenticate users

 - offload the work of authenticating users to load balancer
   - your application can focus on the business logic
     - authenticate users through:
       - identity provider(IdP): OpenIDConnect(OIDC) Compliant
       - cognito user pools:
         - social IdP's such as amazon, facebook or google
         - corporate identities using SAML, LDAP or Microsoft AD 
 - must use an HTTPS listener to set authenticate-oidc and authenticate-cognito rules
 - onunauthenticated request- authenticate(default),deny,allow

**Application Load Balancer - Cognito Auth**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g3flyb7nuj442vpjgias.png)

**Application Load Balancer - OIDC Auth**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6qmifzxn4nfuuz3hoakd.png)


**Cognito Identity pools - diagram**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vh2ygavotsqp16cxgygh.png)

**cognito identity pools - diagram with CUP**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mz1zdzoecwyrycj3tk7k.png)

**Creating Identity pool:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y31bl2ojdlecjdn3spt7.png)

 we can enable the unauthenticated identities and can change the authentication flow. by default it will follow enhanced, we can change to basic flow as well


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8dib7h7z5p5fnrkzcrgg.png)

we can select authentication providers

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4gi2zot4xoldwta8z5tq.png)

pool id and client id needs to be copied from previous steps where we have created the user pool

after creating identity pool it will ask us to allow two IAM roles
1. for authenticates identities
2. unauthenticated identities

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p213u24kh329artbxpvl.png)

we can select the platform where we are installing the SDK and after installation if we run the below code it will generate AWS credentials

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vh3jsvdymx7g6yozcqco.png)

from the dashboard we can check number of authenticated and unauthenticated identities

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1gfgdb3inh2ao6q8x0fa.png)
 

we can customize the IAM roles by navigatin to IAM-> roles

we can see created IAM roles in previous step. by hitting on edit we can customize.

Note:- User pools are for authentication, identity pools for authorisation.