AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless...

Jim Tran and Justin Pirtle

November 30, 2016

MBL306

Serverless Authentication

and Authorization

Identity Management for Serverless Architectures

What to expect from the session

• Assumes high-level familiarity with serverless API

architectures (API Gateway, Lambda)

• Learn how to implement identity management for your

serverless apps, using• Amazon Cognito User Pools

• Amazon Cognito Federated Identities

• Amazon API Gateway

• AWS Lambda

• AWS Identity and Access Management (IAM)

Hybrid mobile app• Runs in web browser, Android, Apple iOS devices

• Built using Ionic 2 Framework

• Angular 2 / TypeScript

• AWS SDKs for JavaScript

Do try this at home• Mobile app + API are open-sourced

(Apache 2.0 license)

• https://github.com/awslabs/

aws-serverless-auth-reference-app

SpaceFinderHelps you book conference rooms and desks

ManagingIdentities

Sign-up and sign-in

1. Sign-up

Sign-up and sign-in

2. Sign-in

Sign-up and sign-in

Username Email Password

beverly123 beverly123@example.com Password$123

pilotjane pilotjane@example.com a##eroplan3

sudhir1977 sudhir197@example.com mmd414997a

2. Sign-in

1. Sign-up

• Never store passwords in plaintext!

• Vulnerable to rogue employees

• A hacked DB results in

all passwords being compromised

Username Email Password

beverly123 beverly123@example.com Password$123

pilotjane pilotjane@example.com a##eroplan3

sudhir1977 sudhir197@example.com mmd414997a

Sign-up and sign-in

2. Sign-in

1. Sign-up

Sign-up and sign-in

Username Email Hashed Password

beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f

pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883

sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d

2. Sign in

1. Sign up

• MD5/SHA1 collisions

• Rainbow Tables

• Dictionary attacks, brute-force (GPUs can compute

billions of hashes/sec)

Username Email Hashed Password

beverly123 beverly123@example.com 21a730e7d6cc9d715efcc0514ed69a1f

pilotjane pilotjane@example.com fea74fde863cd38f88b3393f590ae883

sudhir1977 sudhir197@example.com 6ce6be14f0c775cc9b3dbe4e18d9fc7d

Sign-up and sign-in

2. Sign in

1. Sign up

Sign-up and sign-in

Username Email Salted Hash

beverly123 beverly123@example.com 1e66f9358530620b2bcae79dada717c…

pilotjane pilotjane@example.com 88fccd9cf82377d11d2fede177457d47…

sudhir1977 sudhir197@example.com 08a5981de4fecf04b1359a179962a48...

2. Sign in

1. Sign up

• Incorporate app-specific salt +

random user-specific salt

• Use algorithm with configurable # of iterations (e.g.

bcrypt, PBKDF2), to slow down brute force attacks

Sign-up and sign-in

2. Sign in

1. Sign up

Username Email

beverly123 beverly123@example.com

pilotjane pilotjane@example.com

sudhir1977 sudhir197@example.com

Sign-up and sign-in

Username Email SRP Verifier function

beverly123 beverly123@example.com <password-specific verifier>

pilotjane pilotjane@example.com <password-specific verifier>

sudhir1977 sudhir197@example.com <password-specific verifier>

2. Sign in

1. Sign up

Sign-up and sign-in

2. Sign in

1. Sign up

• Secure Remote Password (SRP) Protocol

• Verifier-based protocol

• Passwords never travel over the wire

• Resistant to several attack vectors

• Perfect Forward Secrecy

Sign-up and sign-in

2. Sign in

1. Sign up

Best practices

☐ Secure password handling

Sign-up and sign-in

2. Sign in

1. Sign up

Best practices

☐ Encrypt all data server-side

☐ Enforce password policies (min length, valid characters)

☐ Token-based Authentication

☐ MFA - via SMS for sign-in and forgot password flows

☐ Support CAPTCHAs and other custom authentication flows

☐ Scalable to 100s of millions of users

Sign-up and sign-in

2. Sign in

1. Sign up

User flows

☐ Registration

☐ Verify email/phone

☐ Secure sign-in

☐ Forgot password

☐ Change password

☐ Sign-out

Best practices

Sign-up and sign-in

2. Sign in

1. Sign up

User flows

☐ Registration

☐ Verify email/phone

☐ Secure sign-in

☐ Forgot password

☐ Change password

☐ Sign-out

Best practices

Amazon Cognito

User Pools

Sign-up and Sign-inAmazon Cognito

User Pools

Sign up and sign inAmazon Cognito

User Pools

Register

User Pools

Register

Verification SMS / Email

User Pools

Register

Verification SMS / Email

Confirm registration

User Pools

Register

Verification SMS or email

Successful registration

User Pools

Register

Authenticate (via SRP)

User Pools

Register

JWT Tokens

User Pools

Register

User Pools

Register

User Pools

Register

Define Authentication

Challenge

User Pools

Register

Challenge

Custom challenge (CAPTCHA, custom 2FA)

User Pools

Register

Challenge

Verify Authentication

Challenge Response

Challenge response

User Pools

Register

Challenge

Challenge Response

Challenge response

JWT Tokens

User Pools

Pre Sign-Up

Validation

Post Confirmation

Custom logic

Challenge

Challenge Response

Pre Authentication

Validation

Post Authentication

custom logic

Register

Challenge response

JWT Tokens

User Pools

JWT Tokens

User Pools

JWT Tokens

JWT token

eyJraWQiOiI5ZXJydERLbHRxOFl3YUp5MkdadE9ieWtSREVB

OVNCNGlEVDZ2V21UZVFFPSIsImFsZyI6IlJTMjU2In0.eyJz

dWIiOiI2ZjU1NzM2OC1hODg0LTQ4NGUtYjY2Mi05ZmM2OWYz

YzM4MDIiLCJhdWQiOiI2bGtmczcwcm92a3ViaXJoMXF0bnR2

ajAxMiIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJ0b2tlbl91

c2UiOiJpZCIsImF1dGhfdGltZSI6MTQ3ODQ0OTA2MCwiaXNz

IjoiaHR0cHM6XC9cL2NvZ25pdG8taWRwLnVzLWVhc3QtMS5h

bWF6b25hd3MuY29tXC91cy1lYXN0LTFfWE1sVVc5c1V5Iiwi

Y29nbml0bzp1c2VybmFtZSI6InRlc3QxMjMiLCJleHAiOjE0

Nzg0NTI2NjAsImdpdmVuX25hbWUiOiJUZXN0IiwiaWF0Ijox

NDc4NDQ5MDYwLCJmYW1pbHlfbmFtZSI6IlRlc3QiLCJlbWFp

bCI6InRyYW5qaW1AYW1hem9uLmNvbSJ9.atQO0SJg9V97d6t

YonHNx0q7Zuof8-d-q0u69zNnuSJtmzGvOAW97tP2e3GydY9

K8q_2kG2IzkpEMUEdaeWjz2qG5dS328Scm6pRDPpC5pOkU8y

mjH7DBPfVXhtgS3iOhyleFhtmaTaYb_lYLpaaV10m8sVFOMH

tjdfrAm26Fq7zyjWYTSfzhqud29Ti4zn9PhcE7aL3s7BB8CJ

18_yFXSoG5CYCpLszvHazx1cbmPoXFrlFlPvZ07Oy8EbOaGs

4CukmoYiV-5RnZsA9JXj405Kp50k-v8HCL6ZACDw3OYMV87P

e6PuEqbzQLlc8BufKThm0xBiO6NJtvI7iC2sEIQ

JWT token

"kid":"9errtDKltq8YwaJy2GZtObykRDEA9SB4iDT6vWmTeQE=",

"alg":"RS256”

Header

JWT token

"sub":"6f557368-a884-484e-b662-9fc69f3c3802",

"aud":"6lkfs70rovkubirh1qtntvj012",

"email_verified":true,

"token_use":"id",

"auth_time":1478449060,

"iss":"https:\/\/cognito-idp.us-east-1.amazonaws.com

\/us-east-1_XMlUW9sUy",

"cognito:username":"test123",

"exp":1478452660,

"given_name”:"Test",

"iat":1478449060,

"family_name":"Test",

"email":”test@example.com"

Payload

JWT token

e6PuEqbzQLlc8BufKThm0xBiO6NJtvI7iC2sEIQSignature

HMACSHA256(base64UrlEncode(header) + "." +

base64UrlEncode(payload), {secret});

JWT token

"kid":"9errtDKltq8YwaJy2GZtObykRDEA9SB4iDT6vWmTeQE=",

"alg":"RS256”

Header

"sub":"6f557368-a884-484e-b662-9fc69f3c3802",

"aud":"6lkfs70rovkubirh1qtntvj012",

"email_verified":true,

"token_use":"id",

"auth_time":1478449060,

"iss":"https:\/\/cognito-idp.us-east-1.amazonaws.com

\/us-east-1_XMlUW9sUy",

"cognito:username":"test123",

"exp":1478452660,

"given_name”:"Test",

"iat":1478449060,

"family_name":"Test",

"email":”test@example.com"

Payload

Signature

HMACSHA256(base64UrlEncode(header) + "." +

base64UrlEncode(payload), {secret});

Application so far…

Amazon Cognito

User Pools

AWS resources

(e.g. Amazon S3)

Amazon Cognito

Federated Identities

Federating access toAWS resources

Federating access to AWS resources

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

3. Get Identity ID

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

4. Identity ID

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

5. GetCredentials (ID JWT Token)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

8. Temporary

AWS credentials

Mobile app

Amazon S3

Amazon Cognito

User Pools

AWS Security Token

Service (STS)

AuthorizingServerless APIs

SpaceFinder API

(Microservice)

Application so far…

Amazon Cognito

User Pools

AWS resources

(e.g. Amazon S3)

Amazon Cognito

SpaceFinder API

POST /locations

GET /locations

GET /locations/{locationId}

DELETE /locations/{locationId}

GET /locations/{locationId}/resources

POST /locations/{locationId}/resources

DELETE /locations/{locationId}/resources/{resourceId}

GET /locations/{locationId}/resources/{resourceId}/bookings

GET /users/{userId}/bookings

POST /users/{userId}/bookings

DELETE /users/{userId}/bookings/{bookingId}

SpaceFinder API

Admin only

POST /locations

GET /locations

GET /locations/{locationId}

DELETE /locations/{locationId}

GET /locations/{locationId}/resources

POST /locations/{locationId}/resources

DELETE /locations/{locationId}/resources/{resourceId}

GET /locations/{locationId}/resources/{resourceId}/bookings

GET /users/{userId}/bookings

POST /users/{userId}/bookings

DELETE /users/{userId}/bookings/{bookingId}

API Gateway: three types of authorization

Amazon Cognito

User Pools

Amazon Cognito

Custom Identity Providers

AWS IAM authorization

Custom Authorizers

User Pools Authorizers

Amazon Cognito

User Pools

Amazon Cognito

Custom Authorizers

Mobile app

AmazonAPIGateway

User Pools authorizers

Amazon Cognito

User Pools

Amazon

DynamoDB

Lambdafunction

Mobile app

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon

DynamoDB

Lambdafunction

Mobile app

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon

DynamoDB

Lambdafunction

Mobile app

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Mobile app

4. Validate

Identity token

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Mobile app

5. Invoke API Call

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Mobile app

6. Access

AWS ResourcesAmazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

User Pools

Amazon Cognito

Custom Authorizers

IAM-based authorization

Mobile app

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

AWS Identity &

Access Management

Mobile app

Amazon Cognito

User Pools

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

AWS Identity &

Access Management

Mobile app

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

3. Request AWS credentials

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

4. Validate Id token

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

5. Temp AWS credentials

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

Amazon

DynamoDB

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Mobile app

8. Invoke Lambda

Lambdafunction

AmazonAPIGateway

Amazon Cognito

User Pools

Amazon Cognito

AWS Identity &

Access Management

Amazon

DynamoDB

IAM policy detail

"Version": "2012-10-17",

"Statement": [

"Action": "execute-api:Invoke",

"Effect": ”Allow",

"Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*"

"Action": "execute-api:Invoke",

"Effect": "Deny",

"Resource": "arn:aws:execute-api:*:*:ff5h9tpwfh/*/POST/locations/*"

Amazon Cognito

User Pools

Amazon Cognito

Custom Authorizers

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Amazon

DynamoDB

AWS Identity &

Access Management

Custom authorizers

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Amazon

DynamoDB

AWS Identity &

Access Management

Custom authorizers

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Amazon

DynamoDB

AWS Identity &

Access Management

Custom authorizers

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Amazon

DynamoDB

AWS Identity &

Access Management

Custom authorizers

Mobile app

Lambdafunction

AmazonAPIGateway

Custom authorizers

Amazon

DynamoDB

4. Check

policy

AWS Identity &

Access Management

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Custom authorizers

Amazon

DynamoDB

AWS Identity &

Access Management

Custom Authorizer

Lambda function

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Custom authorizers

Amazon

DynamoDB

AWS Identity &

Access Management

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Custom authorizers

Amazon

DynamoDB

AWS Identity &

Access Management

Custom Authorizer

Lambda function

Mobile app

Lambdafunction

AmazonAPIGateway

Custom authorizers

Amazon

DynamoDB

8. Invoke Lambda

AWS Identity &

Access Management

Custom authorizer Lambda

var testPolicy = new AuthPolicy(”userIdentifier", "XXXXXXXXXXXX", apiOptions);

testPolicy.allowMethod(AuthPolicy.HttpVerb.POST, "/locations/*");

testPolicy.allowMethod(AuthPolicy.HttpVerb.DELETE, "/locations/*");

callback(null, testPolicy.getPolicy());

Sample Code

Amazon Cognito

User Pools

Amazon Cognito

Custom Authorizers

Integratingwith SAML

SpaceFinder API

(Microservice)

Architecture so far…

Amazon Cognito

User Pools

Enterprise

Identity

Provider

AWS resources

(e.g. Amazon S3)

Amazon Cognito

Integrating with SAML

• Microsoft Active Directory Federation Services (ADFS)

and Shibboleth are popular SAML providers.

• SAML 2.0 supports two bindings:

• POST

• Re-direct

• Capturing the SAML response in a mobile app is non-

trivial.

Endpoint

e.g. ADFS

or Shibboleth

Corporate Directory

e.g. Active Directory

or OpenLDAP

Endpoint

e.g. ADFS

or Shibboleth

Amazon Cognito

2. Get AWS credentials

Corporate Directory

or OpenLDAP

Endpoint

e.g. ADFS

or Shibboleth

Amazon Cognito

2. Get AWS credentials

Corporate Directory

or OpenLDAP

Serverless APIs or AWS resources

Wrap up

SpaceFinder API

(Microservice)

SpaceFinder mobile app

Amazon Cognito

User Pools

Enterprise

Identity

Provider

AWS resources

(e.g. Amazon S3)

Amazon Cognito

SpaceFinder API

(Microservice)

SpaceFinder web app

Amazon Cognito

User Pools

Enterprise

Identity

Provider

AWS resources

(e.g. Amazon S3)

Amazon Cognito

Do try this at home• Mobile app + API are open-sourced (Apache 2.0 license)

https://github.com/awslabs/

aws-serverless-auth-reference-app

SpaceFinder

Thank you!

Remember to complete

your evaluations!

Related Sessions

• MLB404 – Real-World Deep Dive: Native, Hybrid, and

Web with Serverless and AWS Mobile

Services

• MLB310 – Add User Sign-In, User Management, and

Security to your Mobile and Web Applications

with Amazon Cognito

• MLB305 – Developing Mobile Apps and Serverless

Microservices for Enterprises using AWS

AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless...

Technology

Transcript of AWS re:Invent 2016: Serverless Authentication and Authorization: Identity Management for Serverless...

Lambda Serverless & Serverless Microservices · Lambda functions API Gateway Typescript Serverless framework Serverless Microservices Some AWS services and Demo session 2 / Confidential

Innovation with Serverless€¦ · What is serverless. Sub-second billing. Benefits of serverless. Micro-pricing. Ease of scale. Manage less. Architecting for Serverless “We must

AWS re:Invent 2016: Securing Serverless Architectures, and API Filtering at Layer 7 (SAC310)

AWS re:Invent 2016: Getting Started with Serverless Architectures (CMP211)

Serverless & PHPthe future serverless? is PHP's future serverless? try! learn! share! bref.sh null serverless-php.news @matthieunapoli. Title: Bref - February 2020 Created Date:

Conquering Serverless - Serverless Computing...Serverless is cheap enough for every developer to have their own application instances Serverless local development and testing is hard

Serverless Machine Learning on AWS - Serverless Meetup Milano

AWS re:Invent 2016: The State of Serverless Computing (SVR311)

Serverless On Stage - Serverless URL Shortener

Securing Serverless Architectures - AWS Serverless Web Day

Serverless Frameworks · serverless frameworks based on carefully designed set of criteria spanning the serverless application lifecycle • We view a serverless framework as: a software

AWS re:Invent 2016: Serverless to 32 XLarge: A Unified Security Approach To AWS Compute (CMP305)

An NCC Group Publication SERVERLESS ARCHITECTURE: THE FUTURE OF CODE DEPLOYMENT … · An NCC Group Publication | Serverless Architecture 3 Scalability in Serverless Computing Serverless

Kubernetes for Serverless - Serverless Summit 2017 - Krishna Kumar

An NCC Group Publication SERVERLESS ARCHITECTURE: THE ... · An NCC Group Publication | Serverless Architecture 3 Scalability in Serverless Computing Serverless computing offers the

IoT and Serverless - AWS - Serverless Summit - Madhusudan Shekar

AWS re:Invent 2016: All Your Chats are Belong to Bots: Building a Serverless Customer Service Bot (SVR310)

AWS re:Invent 2016: Workshop: Building Serverless Bots on AWS - Botathon (DCS205)

Democratizing Serverless—The Open Source Fn Project - Serverless Summit

AWS re:Invent 2016: Serverless Computing Patterns at Expedia (SVR306) )