Welcome back to BackSpace Academy, in this lab on authentication and 2
synchronization of JavaScript apps with AWS Cognito we're first off going to be 3
creating an AWS Cognito user pool which will store information on users of our 4
application, we're then going to build a trust relationship between this user 5
pool that contains our users to the AWS Cognito ID service, once we've done that 6
we can then write an application that can authenticate a user in that Cognito 7
user pool and then provide them with temporary credentials to access our AWS 8
resources safely, we're then going to use those credentials to write and sync to 9
the AWS Cognito sync service now that is a key store and database service that 10
operates on Cognito and it allows that data to be synchronized across all of 11
the devices that your end user will be logged into, whether it be a mobile 12
application or a desktop computer or whatever, and then we'll also look at 13
using it outside of Cognito and use it with the AWS s3 service to upload an 14
object to Amazon s3, just to show that we don't need to be confined to AWS 15
Cognito we can use these credentials with any of these AWS services, provided 16
that the role that we create that Cognito user allows that to happen. 17
Of all of the requests that I get through Backspace' Academy Cognito would be the 18
number one of those requests, a lot of developers want to know about Cognito, 19
how to use it, how to work their way through the minefield that is the AWS 20
documentation on Cognito, and what I would say is that I have a lot of 21
experience on Cognito, back in late 2014 I was part of the beta testers of 22
Cognito when it came out, and at that stage it wasn't very good, the 23
documentation was atrocious and it was very difficult especially 24
with nodejs and JavaScript, it really wasn't a very good service at all, you 25
had to actually juggle between your Facebook tokens, get them through to 26
STS service, bring him back into here, and bring him back there, and we you ended up 27
having all of these multiple security tokens all over the place just to be 28
able to log in and do something that really wasn't really doing much because 29
back then we didn't have user pools so all these Cognito service could really 30
do is is it could use Facebook or Google or whatever to log in and give you a Cognito 31
ID and then you could use a sync store database to store some key values, you 32
could also use those credentials as well to access s3 and other AWS services but, 33
it wasn't really doing that much. So the good thing was that I did complain to 34
AWS about this and they listened and so at that stage we we did have a 35
support account with AWS and so that certainly was a handy thing to have to 36
be able to go through those channels and then escalate it up to get it all fixed, 37
and so what AWS came out with was a really good JavaScript SDK that included 38
an object that allowed it to to get those credentials for Cognito 39
really within one object, and so it was a really streamlined process and it was 40
really great but at that stage the documentation hadn't caught up and was 41
going to take some time for that to catch up, so what I did was back in early 42
2015 I developed a number of Cognito tutorials on Nodejs and PhoneGap 43
Cordova browser, whole heap of stuff and was extremely popular, Cognito was very 44
very popular and I received thousands, upon thousands, upon thousands of hits 45
and literally hundreds of emails over the last few years on Cognito helping 46
people out, and that was great. Now one thing I would say about Cognito 47
is that parts of it are great and parts of it are not so great and over the last 48
few years it kind of has progressed and a rate of knots and they're 49
introducing a lot of that appears to be cool stuff but not stuff that you really 50
need and not stuff that really works out well and if you have a look at the user 51
forums for AWS and have a look at the Cognito issues that are out there that 52
are unresolved there's a lot of them and a lot of them around these additional 53
SDKs that they've created, we don't just have the AWS 54
JavaScript SDK, we also have the AWS Cognito JavaScript SDK, the AWS 55
Cognito ID JavaScript SDK, the AWS Cognito sync manager SDK, we have the 56
AWS Amplifi SDK, we have the Android, Oh my god we've got them everywhere! 57
Unfortunately you don't really need them and if you want to avoid all those 58
difficulties just use the JavaScript SDK. This is a course on development for 59
certification and you know you need to know how to use the AWS JavaScript SDK 60
it is what I use, I do not use AWS amplify I do not use any of this other 61
stuff because I want to know what works and what works reliably and so what 62
I'm going to do is lead you through this landmine because if you have a look at 63
here at the the documentation a lot of this stuff just doesn't work, the 64
JavaScript code that is in this documentation does not work and when you 65
look at AWS Amplify there's a whole heap of issues around AWS Amplify but the 66
good thing is that they've kept a JavaScript SDK in there and for the most 67
part that does work, so if you're looking for documentation on Cognito for 68
JavaScript go to the AWS Amplify github page and I'll just get that up here and 69
then navigate to packages and then go to Cognito identity.js and that will give 70
you the JavaScript SDK that is current and is being used by AWS amplify and 71
that's the one that you should be using if you're going to be you 72
using a Cognito JavaScript SDK but that said a lot of times you will find that 73
the standard AWS JavaScript SDK which has all of the all of these services for 74
AWS in it does perform better so I use a combination of both 75
AWS say just to use the Cognito identity JavaScript SDK and then they're saying 76
now that well you should use AWS amplify despite the fact that AWS 77
Amplify has a whole heap of issues, what I'll do is I'll show you how to use this 78
Cognito identity SDK and then for the rest of it we're going to use a standard 79
AWS JavaScript SDK and we're also going to use that for the Cognito sync 80
service as well, which has its own SDK as well which you don't need, ok so here we 81
are in the Amazon Cognito console we've got two options here manager user pools 82
or manage your federated identity so to scroll down here we can see that the 83
options available for us with user pools we can add signup and sign-in capability 84
for our applications using user pools and that information will be managed and 85
authenticated with Amazon Cognito on AWS we also have federated user identities 86
and so what they can do is it can provide temporary credentials to enable 87
our federated users to access our AWS resources that could be not only from a 88
Cognito user pool but it also could be from Facebook or Twitter through an 89
OAuth process as well we also have the Cognito sync datastore which enables us 90
to store key value data across our devices and that will be managed again 91
by AWS so the first thing we need to do is to create a user port and we won't be 92
doing any federated identities with Facebook or anything like that will just 93
use Cognito to sign our users in so the first thing we need to do manage our 94
user pools we'll create a user pool 95
and then we click on create a user pool we'll give it a name so once we give it 96
a name we can step through our settings we can just user defaults we might do 97
that we want to learn here plus we do want to make some changes to the 98
defaults so we just step through these settings so the first thing we've got 99
here is how do we want our end users to sign in so we can get them to sign in 100
with just a username and password or we can also you get them to use a verified 101
email address as well so instead of just typing in their username they can still 102
do that but if they forget their username they can always put in their 103
email address so that's probably good one we might worry about using a 104
verified phone number or a preferred username so we can actually have it 105
signing into the preferred username if we if we would like but we'll just leave 106
it like that so they can use their username and and and their email address 107
next we have a standard attributes that we can attach so when they sign up we 108
can get information from them so the first thing that we are going to get is 109
going to be an email we're also going to grab a preferred username so instead of 110
just giving them a username we'll give them the opportunity to choose a 111
username and to type that in that's always a good thing 112
will select birthdate probably a good thing to grab family name gender given 113
name what else can we put on them we'll put the website on them and I 114
think that'll do us for now so now we'll scroll down to custom attributes so if 115
what we're collecting there is not enough for us for a profile of this user 116
we can add a cups custom attribute there so just say for example might be a 117
professional site and we want to get their LinkedIn page as well so we can do 118
s add custom attribute here and we're going to put in LinkedIn okay all 119
lowercase we'll click on next step next we'll have a look at what past word 120
strength do you require so we can see here we require numbers 121
special characters uppercase I'll leave that as it is minimum 8 8 for length 122
that sounds ok do you want to allow users to sign themselves up so we can 123
have the opportunity for them to sign themselves up which you would probably 124
use or if you just want to have a you know private access and you won't only 125
want administrators to to sign people up then you can you can have that as well 126
but we're going to allow anyone to sign themselves up and if administrators sign 127
up you want those to expire how long and so we're just gonna leave that at 7 days 128
so they don't expire they sign themselves up but if you sign someone up 129
and they don't take a sign in then it or we can delete those old accounts quite 130
quickly all those old users in our user pool click on next step do you want to 131
enable multi-factor authentication great we can do that if we want we won't for 132
this it's just a simple website so but that capability is available for us do 133
you want to require verification of emails or phone numbers so yes we're 134
going to be using an email to log in and you know we want them if we're going to 135
sign people up we might as well get their email address and we need to 136
provide a role to allow Amazon Cognito to send SMS messages no we don't need to 137
worry about that because we haven't got multi-factor authentication done them so 138
we don't need access to a SMS service so we don't need to worry about that just 139
leave it as it is and we'll just click on next step now when someone signs up 140
they're going to receive an e-mail verification because we've we've told 141
cognate oh that we want all these emails to be verified so they can send a 142
verification code so when someone signs up a message will pop up saying into 143
your verification code and then they go back to their email address and they get 144
that verification code type it in I think that's a little bit of work so 145
we're just going to use a link so when they sign up they will receive an email 146
with a link they may leave verify the email 147
for them so this we can we can customize this so your verification you link for 148
we can customize our SMS messages and we're not using SMS here so we're not 149
going to worry about that we can customize our email invitation messages 150
if we want do you want to customize your email address so normally it would just 151
come with a random or not a random but a generic email address no reply to 152
whatever so you can actually put your own from address or reply to address in 153
there we won't worry about that for this and we'll click on next step you want to 154
add tags to this user for we can add tags if we want to keep track of things 155
we're not going to worry about that here do you want to remember your users 156
devices we won't worry about that either and which app clients will have access 157
to this user porn so what we're going to do we get we are going to have an app 158
that we're going to be using that will be accessing this user pool so we need 159
to actually grant access and build a relationship or trust between that 160
application and this client in this user pool so we add an app client we're going 161
to give that a name now we don't do generate client secret we keep that off 162
we don't need that you don't just stop our application from working so we just 163
leave it at that give it a give it a name and create that apps client now we 164
also have the option of having customized workflows with triggers so we 165
can actually implement a trigger that can implement a lambda function to go 166
ahead and do something so before we sign up we can have a lambda function that 167
has to do something you know ask them to enter the words Kalamazoo or whatever it 168
does so we can we can make that happen when we have pre authentication so we 169
have a whole heap of triggers that we can introduce into that workflow which 170
provides a lot more our for our authentication service we're 171
just going to leave everything as it is and it will click on next step so we can 172
just review it now which looks fine and create pool so user pool was created 173
successfully it was quite easy to do now the next thing we need to do is to 174
modify some of this stuff here so we need to go into app client settings and 175
click on that and we need to add a cog need to Cognito user pool we can do a 176
sign-in and sign-out URLs so the callback use we'll just leave that as it 177
is and save the changes for that what we can do now is choose a domain name as 178
well for our application so I'm just going to call this one backspace - slip 179
and check the availability so it needs to be something that's unique this 180
domain is available so if you try and use backspace - letters are going to 181
work for it's just like an s3 bucket needs to be unique so you know use 182
backspace - your surname or something like that so just Save Changes now that 183
we know that's in they all say the domain has been successfully created so 184
now that that's all done we now need to go in and do our federated identities 185
which we will do in the next part