AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless Architectures (MBL306)
•
11 likes•11,780 views
By leveraging "serverless architectures", startups and enterprises are building and running modern applications and services with increased agility and simplified scalability—all without managing a single server. Many applications need to manage user identities and support sign-in/sign-up. In this session, we dive deep on how to support millions of user identities, as well as how to integrate with social identity providers (such as Google and Facebook) and existing corporate directories. You learn the real-world design patterns that AWS customers use to implement authentication and authorization. By combining Amazon Cognito identity pools and user pools with API Gateway, AWS Lambda, and AWS IAM, you can add security without adding servers.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless Architectures (MBL306)
Similar to AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless Architectures (MBL306) (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless Architectures (MBL306)
- 1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Jim Tran and Justin Pirtle November 30, 2016 MBL306 Serverless Authentication and Authorization Identity Management for Serverless Architectures
- 2. What to expect from the session • Assumes high-level familiarity with serverless API architectures (API Gateway, Lambda) • Learn how to implement identity management for your serverless apps, using • Amazon Cognito User Pools • Amazon Cognito Federated Identities • Amazon API Gateway • AWS Lambda • AWS Identity and Access Management (IAM)
- 3. Hybrid mobile app • Runs in web browser, Android, Apple iOS devices • Built using Ionic 2 Framework • Angular 2 / TypeScript • AWS SDKs for JavaScript Do try this at home • Mobile app + API are open-sourced (Apache 2.0 license) • https://github.com/awslabs/ aws-serverless-auth-reference-app SpaceFinder Helps you book conference rooms and desks
- 7. 1. Sign-up Sign-up and sign-in 2. Sign-in
- 8. Sign-up and sign-in Username Email Password beverly123 beverly123@example.com Password$123 pilotjane pilotjane@example.com a##eroplan3 sudhir1977 sudhir197@example.com mmd414997a 2. Sign-in 1. Sign-up
- 9. • Never store passwords in plaintext! • Vulnerable to rogue employees • A hacked DB results in all passwords being compromised Username Email Password beverly123 beverly123@example.com Password$123 pilotjane pilotjane@example.com a##eroplan3 sudhir1977 sudhir197@example.com mmd414997a Sign-up and sign-in 2. Sign-in 1. Sign-up
- 10. Sign-up and sign-in Username Email Hashed Password beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883 sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d 2. Sign in 1. Sign up
- 11. • MD5/SHA1 collisions • Rainbow Tables • Dictionary attacks, brute-force (GPUs can compute billions of hashes/sec) Username Email Hashed Password beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883 sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d Sign-up and sign-in 2. Sign in 1. Sign up
- 12. Sign-up and sign-in Username Email Salted Hash beverly123 beverly123@example.com 1e66f9358530620b2bcae79dada717c… pilotjane pilotjane@example.com 88fccd9cf82377d11d2fede177457d47… sudhir1977 sudhir197@example.com 08a5981de4fecf04b1359a179962a48... 2. Sign in 1. Sign up • Incorporate app-specific salt + random user-specific salt • Use algorithm with configurable # of iterations (e.g. bcrypt, PBKDF2), to slow down brute force attacks
- 13. Sign-up and sign-in 2. Sign in 1. Sign up Username Email beverly123 beverly123@example.com pilotjane pilotjane@example.com sudhir1977 sudhir197@example.com
- 14. Sign-up and sign-in Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign in 1. Sign up
- 15. Sign-up and sign-in Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign in 1. Sign up • Secure Remote Password (SRP) Protocol • Verifier-based protocol • Passwords never travel over the wire • Resistant to several attack vectors • Perfect Forward Secrecy
- 16. Sign-up and sign-in Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign in 1. Sign up Best practices ☐ Secure password handling
- 17. Sign-up and sign-in Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign in 1. Sign up Best practices ☐ Secure password handling ☐ Encrypt all data server-side ☐ Enforce password policies (min length, valid characters) ☐ Token-based Authentication ☐ MFA - via SMS for sign-in and forgot password flows ☐ Support CAPTCHAs and other custom authentication flows ☐ Scalable to 100s of millions of users
- 18. Sign-up and sign-in Username Email SRP Verifier function beverly123 beverly123@example.com <password-specific verifier> pilotjane pilotjane@example.com <password-specific verifier> sudhir1977 sudhir197@example.com <password-specific verifier> 2. Sign in 1. Sign up User flows ☐ Registration ☐ Verify email/phone ☐ Secure sign-in ☐ Forgot password ☐ Change password ☐ Sign-out Best practices ☐ Secure password handling ☐ Encrypt all data server-side ☐ Enforce password policies (min length, valid characters) ☐ Token-based Authentication ☐ MFA - via SMS for sign-in and forgot password flows ☐ Support CAPTCHAs and other custom authentication flows ☐ Scalable to 100s of millions of users
- 19. Sign-up and sign-in 2. Sign in 1. Sign up User flows ☐ Registration ☐ Verify email/phone ☐ Secure sign-in ☐ Forgot password ☐ Change password ☐ Sign-out Best practices ☐ Secure password handling ☐ Encrypt all data server-side ☐ Enforce password policies (min length, valid characters) ☐ Token-based Authentication ☐ MFA - via SMS for sign-in and forgot password flows ☐ Support CAPTCHAs and other custom authentication flows ☐ Scalable to 100s of millions of users Amazon Cognito User Pools
- 20. Sign-up and Sign-in Amazon Cognito User Pools
- 21. Sign up and sign in Amazon Cognito User Pools Register
- 22. Sign up and sign in Amazon Cognito User Pools Register Verification SMS / Email
- 23. Sign up and sign in Amazon Cognito User Pools Register Verification SMS / Email Confirm registration
- 24. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration
- 25. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Authenticate (via SRP)
- 26. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Authenticate (via SRP) JWT Tokens
- 27. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration
- 28. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Authenticate (via SRP)
- 29. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Authenticate (via SRP) Define Authentication Challenge
- 30. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Define Authentication Challenge Custom challenge (CAPTCHA, custom 2FA) Authenticate (via SRP)
- 31. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Define Authentication Challenge Verify Authentication Challenge Response Custom challenge (CAPTCHA, custom 2FA) Authenticate (via SRP) Challenge response
- 32. Sign up and sign in Amazon Cognito User Pools Register Verification SMS or email Confirm registration Successful registration Define Authentication Challenge Verify Authentication Challenge Response Custom challenge (CAPTCHA, custom 2FA) Authenticate (via SRP) Challenge response JWT Tokens
- 33. Sign up and sign in Amazon Cognito User Pools Pre Sign-Up Validation Post Confirmation Custom logic Define Authentication Challenge Verify Authentication Challenge Response Pre Authentication Validation Post Authentication custom logic Register Verification SMS or email Confirm registration Successful registration Authenticate (via SRP) Custom challenge (CAPTCHA, custom 2FA) Challenge response JWT Tokens
- 34. Sign up and sign in Amazon Cognito User Pools Authenticate (via SRP) JWT Tokens
- 35. Sign up and sign in Amazon Cognito User Pools Authenticate (via SRP) JWT Tokens
- 41. Application so far… Amazon Cognito User Pools AWS resources (e.g. Amazon S3) Amazon Cognito Federated Identities
- 43. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 44. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 45. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 46. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS) 3. Get Identity ID
- 47. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS) 4. Identity ID
- 48. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS) 5. GetCredentials (ID JWT Token)
- 49. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 50. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 51. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS) 8. Temporary AWS credentials
- 52. Federating access to AWS resources Trottling Cache Logging Monitoring Auth Mobile app Amazon S3 Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Security Token Service (STS)
- 53. DEMO
- 55. SpaceFinder API (Microservice) Application so far… Amazon Cognito User Pools AWS resources (e.g. Amazon S3) Amazon Cognito Federated Identities
- 56. SpaceFinder API POST /locations GET /locations GET /locations/{locationId} DELETE /locations/{locationId} GET /locations/{locationId}/resources POST /locations/{locationId}/resources DELETE /locations/{locationId}/resources/{resourceId} GET /locations/{locationId}/resources/{resourceId}/bookings GET /users/{userId}/bookings POST /users/{userId}/bookings DELETE /users/{userId}/bookings/{bookingId}
- 57. SpaceFinder API Admin only Admin only Admin only Admin only POST /locations GET /locations GET /locations/{locationId} DELETE /locations/{locationId} GET /locations/{locationId}/resources POST /locations/{locationId}/resources DELETE /locations/{locationId}/resources/{resourceId} GET /locations/{locationId}/resources/{resourceId}/bookings GET /users/{userId}/bookings POST /users/{userId}/bookings DELETE /users/{userId}/bookings/{bookingId}
- 58. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
- 59. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
- 60. Trottling Cache Logging Monitoring Auth Mobile app AmazonAPI Gateway User Pools authorizers Amazon Cognito User Pools Amazon DynamoDB Lambda function
- 61. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers AmazonAPI Gateway Amazon Cognito User Pools Amazon DynamoDB Lambda function
- 62. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers AmazonAPI Gateway Amazon Cognito User Pools Amazon DynamoDB Lambda function
- 63. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers Amazon DynamoDB Lambda function AmazonAPI Gateway Amazon Cognito User Pools
- 64. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers 4. Validate Identity token Amazon DynamoDB Lambda function AmazonAPI Gateway Amazon Cognito User Pools
- 65. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers 5. Invoke API Call Amazon DynamoDB Lambda function AmazonAPI Gateway Amazon Cognito User Pools
- 66. Trottling Cache Logging Monitoring Auth Mobile app User Pools authorizers 6. Access AWS Resources Amazon DynamoDB Lambda function AmazonAPI Gateway Amazon Cognito User Pools
- 67. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
- 68. IAM-based authorization Trottling Cache Logging Monitoring Auth Mobile app Amazon DynamoDB Lambda function AmazonAPI Gateway Amazon Cognito Federated Identities Amazon Cognito User Pools AWS Identity & Access Management
- 69. Trottling Cache Logging Monitoring Auth Mobile app Amazon Cognito User Pools Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito Federated Identities AWS Identity & Access Management
- 70. Trottling Cache Logging Monitoring Auth Mobile app Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 71. Trottling Cache Logging Monitoring Auth Mobile app 3. Request AWS credentials Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 72. Trottling Cache Monitoring Auth Mobile app 4. Validate Id token Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 73. Trottling Cache Logging Monitoring Auth Mobile app 5. Temp AWS credentials Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 74. Trottling Cache Logging Monitoring Mobile app Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 75. Trottling Cache Logging Monitoring Mobile app Amazon DynamoDB Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management
- 76. Trottling Cache Logging Monitoring Mobile app 8. Invoke Lambda Lambda function AmazonAPI Gateway IAM-based authorization Amazon Cognito User Pools Amazon Cognito Federated Identities AWS Identity & Access Management Amazon DynamoDB
- 77. IAM policy detail { "Version": "2012-10-17", "Statement": [ { "Action": "execute-api:Invoke", "Effect": ”Allow", "Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*" }, { "Action": "execute-api:Invoke", "Effect": "Deny", "Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*/POST/locations/*" } ] }
- 78. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
- 79. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Amazon DynamoDB AWS Identity & Access Management Custom authorizers
- 80. Custom Authorizer Lambda function Mobile app Lambda function AmazonAPI Gateway Amazon DynamoDB AWS Identity & Access Management Custom authorizers
- 81. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Amazon DynamoDB AWS Identity & Access Management Custom authorizers
- 82. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Amazon DynamoDB AWS Identity & Access Management Custom authorizers
- 83. Auth Mobile app Lambda function AmazonAPI Gateway Custom authorizers Amazon DynamoDB 4. Check policy cache AWS Identity & Access Management Custom Authorizer Lambda function
- 84. Auth Mobile app Lambda function AmazonAPI Gateway Custom authorizers Amazon DynamoDB 5.Validatetoken AWS Identity & Access Management Custom Authorizer Lambda function
- 85. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Custom authorizers Amazon DynamoDB 6.Generateandreturn userIAMpolicy AWS Identity & Access Management
- 86. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Custom authorizers Amazon DynamoDB AWS Identity & Access Management
- 87. Custom Authorizer Lambda function Auth Mobile app Lambda function AmazonAPI Gateway Custom authorizers Amazon DynamoDB 8. Invoke Lambda AWS Identity & Access Management
- 88. Custom authorizer Lambda var testPolicy = new AuthPolicy(”userIdentifier", "XXXXXXXXXXXX", apiOptions); testPolicy.allowMethod(AuthPolicy.HttpVerb.POST, "/locations/*"); testPolicy.allowMethod(AuthPolicy.HttpVerb.DELETE, "/locations/*"); callback(null, testPolicy.getPolicy()); Sample Code
- 89. API Gateway: three types of authorization Amazon Cognito User Pools Amazon Cognito Federated Identities Custom Identity Providers AWS IAM authorization Custom Authorizers User Pools Authorizers
- 90. DEMO
- 92. SpaceFinder API (Microservice) Architecture so far… Amazon Cognito User Pools Enterprise Identity Provider AWS resources (e.g. Amazon S3) Amazon Cognito Federated Identities
- 93. Integrating with SAML • Microsoft Active Directory Federation Services (ADFS) and Shibboleth are popular SAML providers. • SAML 2.0 supports two bindings: • POST • Re-direct • Capturing the SAML response in a mobile app is non- trivial.
- 94. SAML Endpoint e.g. ADFS or Shibboleth Integrating with SAML Corporate Directory e.g. Active Directory or OpenLDAP
- 95. SAML Endpoint e.g. ADFS or Shibboleth Amazon Cognito Federated Identities 2. Get AWS credentials Integrating with SAML Corporate Directory e.g. Active Directory or OpenLDAP ?
- 96. SAML Endpoint e.g. ADFS or Shibboleth Amazon Cognito Federated Identities 2. Get AWS credentials Integrating with SAML Corporate Directory e.g. Active Directory or OpenLDAP Serverless APIs or AWS resources
- 97. Wrap up
- 98. SpaceFinder API (Microservice) SpaceFinder mobile app Amazon Cognito User Pools Enterprise Identity Provider AWS resources (e.g. Amazon S3) Amazon Cognito Federated Identities
- 99. SpaceFinder API (Microservice) SpaceFinder web app Amazon Cognito User Pools Enterprise Identity Provider AWS resources (e.g. Amazon S3) Amazon Cognito Federated Identities
- 100. Do try this at home • Mobile app + API are open-sourced (Apache 2.0 license) https://github.com/awslabs/ aws-serverless-auth-reference-app SpaceFinder
- 101. Thank you!
- 102. Remember to complete your evaluations!
- 103. Related Sessions • MLB404 – Real-World Deep Dive: Native, Hybrid, and Web with Serverless and AWS Mobile Services • MLB310 – Add User Sign-In, User Management, and Security to your Mobile and Web Applications with Amazon Cognito • MLB305 – Developing Mobile Apps and Serverless Microservices for Enterprises using AWS