I have a multiple AWS account w/ Cognito User Pool and another AWS account w/ Cognito Identity Pool. Is there any way to add those Cognito User Pools to Cognito Identity Pool on another AWS Account? or can I connect them via OpenID, SAML or Custom Protocol?
I'm trying to add AWS_IAM authorization on API Gateway so that all users that are authorized on said User Pool can access the API after logging in on Identity Pool.
Thank you in advance.
I have a Java backend service and i want to use AWS Cognito to provide authentication and access to AWS services. This service do not have any information about the AWS account. I see that all the clients required AWS credentials or admin credentials for their creation. How can i give access to this service with only using a user from the user pool without any knowledge of the AWS account?
I have tried the client side and server side but they both need aws credentials to create a user pool and identity pool client which then can get access tokens.
try {
credentials = new ProfileCredentialsProvider("default").getCredentials();
} catch (Exception e) {
throw new AmazonClientException(
"Cannot load the credentials from the credential profiles file. " +
"Please make sure that your credentials file is at the correct " +
"location (/Users/ayushaws/.aws/credentials), and is in valid format.",
e);
}
// Creating Cognito user pool client
AWSCognitoIdentityProvider client = AWSCognitoIdentityProviderClientBuilder.standard()
.withRegion("us-east-1")
.withCredentials(new AWSStaticCredentialsProvider(credentials))
.build();
This is how i am currently creating my client. My question is this requires my credentials initially to create a client. How do we create a client if the app using is outside of AWS and have no knowledge of AWS account.
You need to be using credentials with sufficient privileges to create the Cognito User Pool and the Cognito Identity Pool. Since you're using Cognito you should be able to handle auth and access in your client side application, and your application does not need long term credentials, as Identity Pool will provide the necessary credentials.
In your client application, the user will login to the Cognito User Pool directly. When they successfully login to the User Pool they'll receive a response which includes an IdToken. You then add the IdToken to the credentials map and that will grant the user access to the resources that the Identity Pools Authenticated IAM role permits.
You can read more about how to use Cognito User Pools in conjunction with Cognito Identity Pools in the AWS Cognito docs.
Question
Why AWS Cognito has two places to federate Identity Providers? I think Identity Pool is supposed to be federated with identity providers and wonder why User Pool also can. Kindly suggest the reason why having two locations.
Cognito Identity Pool can federate identity providers.
Cognito User Pool can federate identity provides as well.
User Pool
User pools are for authentication (identity verification). With a user pool, your app users can sign in through the user pool (which is essentially a user directory in Amazon Cognito) or federate through a third-party identity provider (IdP), for example social identity providers like Google, Facebook, Amazon, or Apple, and through SAML identity providers.
After successfully authenticating a user, Amazon Cognito issues JSON web tokens (JWT) that you can use to secure and authorize access to your own APIs, or exchange for AWS credentials (here is where Identity Pool comes into play).
Use a user pool when you need to:
Design sign-up and sign-in webpages for your app.
Access and manage user data.
Track user device, location, and IP address, and adapt to sign-in requests of different risk levels.
Use a custom authentication flow for your app.
Identity Pool
Identity pools are for authorization (access control). With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services.
Use an identity pool when you need to:
Give your users access to AWS resources, such as an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon DynamoDB table.
Generate temporary AWS credentials for unauthenticated users (User Pools support anonymous guest users).
Identity pools provide AWS credentials to grant your users access to other AWS services. To enable users in your user pool to access AWS resources, you can configure an identity pool to exchange user pool tokens for AWS credentials.
Sources:
https://aws.amazon.com/premiumsupport/knowledge-center/cognito-user-pools-identity-pools/
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools.html
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html
The Main Difference is how users are saved and what permissions are granted once they signin with idp's using user pool vs identity pool.
So, Federation through User Pool (by themselves) don’t deal with permissions at the IAM-level which doesn't allow for a much more granular set of permissions, with respect to AWS services.
However Identity Pools creates a user from an Identity Provider with unique identities such as an IAM role, they essentially allow you to delegate authorization for AWS resources to AWS itself.
Refer here for scenarios!!
A similar source of confusion is caused by the fact that you can integrate external social providers like Facebook and Google with User Pools directly, without using Federated Identities at all. Using this approach, users can sign up and sign in to your app with their Facebook login, but they never get assigned an IAM role. Instead, the User Pool service automatically assigns these users to a Facebook group, and then maps the attributes of their Facebook profile (e.g. name, email, location) to the user attributes you’ve defined in your User Pool. Again, the key distinction here is not whether the Identity Provider is internal or external, but rather if an IAM role is assigned to the user after authentication.
Hope it Helps.
AWS provides cognito which provides the developer with sign-up and sign-in functionality including federations with OpenId compatible identity providers such as facebook, google etc.
There are two types of categories in cognito developer console. These are managing user pool and managing federated identities.
I'm just a little bit confused because both are very similar even we want to provide our client to login with their facebook account.
The cognito user pool itself provides federation and federation identity pool also provide it by authentication providers.
The question is that if I want to allow my clients to use their own facebook account for sign-in, which categories should I use? user pool or federated identities?
In addition, if I want to configure authorizer in API gateway I have to create cognito user pool but federated identity pool. Is that the main reason choosing the cognito category?
Cognito user pool:
Amazon Cognito User Pool makes it easy for developers to add sign-up
and sign-in functionality to web and mobile applications. It serves as
your own identity provider to maintain a user directory. It supports
user registration and sign-in, as well as provisioning identity tokens
for signed-in users.
Cognito Federated Identities or Identity Pool:
Cognito Identity Pool (or Cognito Federated Identities) on the other
hand is a way to authorize your users to use the various AWS services.
Say you wanted to allow a user to have access to your S3 bucket so
that they could upload a file; you could specify that while creating
an Identity Pool. And to create these levels of access, the Identity
Pool has its own concept of an identity (or user). The source of these
identities (or users) could be a Cognito User Pool or even Facebook or
Google.
Relationship between User pool and Identity pool:
The Cognito Identity Pool simply takes all the identity providers and puts them together (federates them). And with all of this it can now give your users secure access to your AWS services, regardless of where they come from.
So in summary, the Cognito User Pool stores all the users which then plugs into Cognito Identity Pool which can give the users access to AWS services.
source
You can think of user pools as sort of a directory which contains user attributes such as name, email, phone number etc. This also provides sign up, sign in capability. You can federate users into user pools. Currently you can use Facebook, Google, and SAML as identity providers for user pools.
Cognito Federated identities lets you federate users into AWS and vends AWS credentials that can be used to access the resources you allow in your policy. For Cognito Federated Identities, you also have a variety of identity providers that you can configure such as Facebook, Google, and also Cognito User Pools can be an identity provider.
What you use depends on your use case. If you don't require AWS resources for your app, probably User Pools is all you need.
I believe AWS should separate User Pool and Identity Pool, and change the names. Because mixing up different services under the same name causes confusions, and the names do not give any clue about the services.
User Pool -> AWS Authentication and Token vending service, similar to Auth0. You can use Auth0 instead of unnecessarily complicated User Pool
Identity Pool -> AWS IAM Authorization service for the authentication tokens such as Auth0 token or AWS JWT token (from User Pool)
An analogy would be:
Use Pool is an agency in your country that identifies who you are and issues a VISA (The VISA is the token which the Identity Provider provides you as a user).
Identity Pool is the border control of the foreign country called "AWS" that you visit with the VISA. They verify who you are with the VISA and authorize what you can do in there. If the border control does not recognize the VISA, you cannot do anything. If they recognize it, then they have fine grained rules defined for each VISA what actions are allowed and where.
Forget about User Pool
Better focus on Identity Pool. Because User Pool is just another Identity Provider service like MSAD, Google, Facebook, Auth0, etc. An Identity Provider authenticates and provides a token e.g. Kerberos Token for a MS AD users, or a Cognito Userpool JWT token for a AWS Cognito Userpool user. Then Identity Pool can utilize the token to authorize access to AWS resources.
AWS has been mixing up this Identity Provider/Authentication service with Identity Pool/Authorization service, besides their strange naming, hence causing massive confusions, incurring the questions.
The name "Identity Pool" does not make any sense as it has no indication on what the service does. A word must navigate thinking that leads to understanding, not confusion. AWS exactly does the opposite.
Preparation
Before jumping to what Identity Pool does/is, better to understand a few things.
AWS STS Token
Naively saying, AWS STS Token allow us to create, use, update, delete AWS resources programmatically.
AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_SESSION_TOKEN
If you have an AWS account user, you can get AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for the user, and then get a STS token using e.g. MFA.
IAM Role
In reality, an IAM Role defines which actions allowed on which AWS resources for a STS token. It may not allow delete but create. So it depends on the IAM Role what a STS Token allows us to do.
However, the point to note is, there is a association between an IAM Role and a STS Token you get, and someone must define the association for you.
What Identity Pool gives you
It gives a STS Token, using which you can manipulate AWS resources in an AWS account.
Situation where Identity Pool is useful
Another problem of AWS for me is their documentation does not declare This is when you need Identity Pool, but instead keep repeating the word Federation which does not point to what Identity Pool does, allow you to manipulate AWS resources with a STS Token.
If you are in the situation where:
I want to manipulate AWS resources in an AWS account, and
I do not have an AWS IAM User (or I do not want to use it), but
I have an account in Corporate AD, or in Google, or in Facebook, or in Auth0, or ..., or in Cognito User Pool.
Then you can use Identity Pool to get a STS token for the account e.g Google you logged in, and can manipulate the AWS resource.
For instance, if you have 1000+ users in your corporate AD and want to let them use AWS resources somehow. Would you create 1000+ AWS IAM users? Or find a way to map them to a few IAM roles such as "Administrator", "Accounting", "Finance", "IT"?
What Identity Pool does
Identity Pool maps an Identity Provider token (e.g. Google token) to an IAM Role in an AWS account, and gives a STS Token.
AWS calls this "mapping" as Federation, in my understanding.
I would recommend completely forgetting User Pool when discussing Identity Pool. User Pool is just another Identity Provider which you may not need at all.
Likewise, when discussing User Pool, I would recommend completely forgetting Identity Pool.
I do hope AWS will separate Identity Provider Service (User Pool) from Token Mapping service (Identity Pool) to stop causing confusions.
The best summary I have ever heard is:
user pools return JSON Web Tokens (JWTs) which are used to access APIs that you built (using api gateway or appsync)
identity pools return Security Token Service (STS) tokens that are used to access APIs that aws built (s3, dynamodb, etc.)
Watch this cognito deep dive video for more details.
The below picture is a good answer to the question (User pool Vs Identity Pool)
I am currently using AWS cognito for user authentication. Now i want to store partial information of the users in the user pool to DynamoDb table. Is there a way to relate Userpool data with DynamoDb ?
You can federate user pool with Cognito identity and get the scoped temporary credentials, you can use these credentials to connect to DynamoDB. This part of developer guide talks about this integration. integrating user pools with identity pools