Search code examples
androidauthenticationamazon-web-servicesmobile-application

Typical app user authentication using AWS

My main question is what is the typical way mobile apps authenticate users? I know that AmazonCognito is used to sync userdata once you receive a token, but that token is simply a set of access rules, right? Which has nothing to do with a particular user (just the fact that they are an authenticated user in general).

But before even that, there needs to be a way to authenticate a username/pass that the user signed up for so that you can retrieve the token. In almost all of the documentation, they use Facebook/Google/etc as examples of third party providers, and there IS an example of setting up your own 3rd party provider, but this all requires your own backend to service that. C

onsidering that there may be many users trying to user the app and authenticate, does it not seem like a bad idea to set up a backend somewhere else? And is there a way to integrate this part into AWS as well so that there is no custom backend work? How is this typically done?

Site node: I'm using Android SDK at the moment.

Thanks :)

Solution

  • AWS Cognito has two different purposes. One is to synchronize data as you described in your question. The other one is to help to manage user identities and create the glue between external Identity Providers (your own, Facebook, Google or Amazon) and AWS.

    Here is the workflow at high level. Details are available at http://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html

    1. Using AWS Console, create a Cognito Identity Pool

    2. Associate two IAM Policies to your Cognito Identity Pool. One for the unauthenticated users and one for authenticated users. Best practices is to grant least privileges to both category of users. The AWS Console will help you to go through these steps and will propose reasonable default values.

    3. In your code, initialize your CognitoCredentialsProvider object as this

    CognitoCachingCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider( myActivity.getContext(), // get the context for the current activity "AWS_ACCOUNT_ID", "COGNITO_IDENTITY_POOL", "arn:aws:iam::AWS_ACCOUNT_ID:role/UNAUTHENTICATED_ROLE", "arn:aws:iam::AWS_ACCOUNT_ID:role/AUTHENTICATED_ROLE", Regions.US_EAST_1 );

    1. In your code, proceed as usual to authenticate your users (using your own provider or Facebook, Google or Amazon)

    2. When you will receive the token issued by the Identity Provider, associate it to Cognito. The Cognito SDK will transparently trade this token for a temporary AWS Access Key, Secret Key that service clients can use.

    3. Give the credentials provider to your service client object, such as

    AmazonDynamoDB client = new AmazonDynamoDBClient(credentialsProvider);

    This approach allows you to avoid to deploy your own backend as broker to AWS services. Most service calls can be made directly from the mobile app, allowing a good level of scalability at a low cost.

    Backend of your own is only required to offload some computing task of your mobile devices or if you want to implement your own Identity provider and make it interact with Cognito (see detailed workflow at http://mobile.awsblog.com/post/Tx2FL1QAPDE0UAH/Understanding-Amazon-Cognito-Authentication-Part-2-Developer-Authenticated-Ident)