‫So, let's have a look at Cognito.
‫I'm gonna go into the Cognito console
‫and here I am greeted with two options.
‫I can create a user pool or I could create an identity pool.
‫We'll see identity pool later on,
‫so for now, let's just create a user pool.
‫So here, we have the console and we have several options.
‫So, what is the authentication provider to the pool?
‫How do people sign in?
‫So we can have a Cognito user pool sign in with,
‫they can use their user email address,
‫phone number, username, and then a password.
‫Or we can choose to federate identity providers.
‫And if I do so, then they will be able to log in
‫with Google, with Facebook, with Amazon, of your Apple.
‫But if you just want to allow Federated sign in,
‫then it's better to choose an identity pool
‫and we'll see this later on,
‫but if you want more than just the sign in,
‫then you can stay here.
‫Okay, so we'll just keep things as the Cognito user pool.
‫And then, what is the signing option?
‫How do I want users to sign in?
‫Is it by username?
‫Is it by email, by phone number, and so on.
‫So, we can say, okay, username is good
‫and then we'll click on Next.
‫Next, we have the security requirements for Cognito,
‫so what are the passwords requirements?
‫We can use the defaults
‫or we can customize this and say for example,
‫you don't care about all these password requirements
‫for security response.
‫For example, a minimum of six characters
‫and you're good to go.
‫Then, the temporary passwords, set by administrators,
‫when do they expire?
‫Seven days is good.
‫Next, we have multifactor authentication,
‫so do we want our users to use MFA
‫during their signing process?
‫And we can require MFA for added security.
‫Have it optional,
‫so that users choose to control their own security.
‫Or no MFA, in which case the users cannot use MFA.
‫This is the least secure option.
‫And in case you have MFA
‫do you want to use an authenticator app,
‫or do you want to use an SMS message
‫to send to verified phone number?
‫So right now we'll do no MFA.
‫And then, do you have self-service account recovery?
‫Do you want to basically allow people
‫to have a forgot their password link displayed?
‫Yes, for example.
‫And then, how do you want to deliver
‫the account recovery messages?
‫Is it by email, by SMS, email if available,
‫otherwise SMS and so on.
‫So these options are things you're quite familiar with
‫because they are the options that you have
‫from pretty much any website
‫where you create a user account.
‫But here we have full control over it
‫and that's pretty cool because it's a managed service.
‫Moving on, yes, we want users to be able to sign in
‫by themselves and sign up by themselves.
‫And then, how do we verify these things?
‫So, we can have Cognito
‫to send messages automatically and verify.
‫We verify the email address by sending an email
‫and then how do we verify attributes changed?
‫They changed their email address
‫or they changed their phone number.
‫Again, we can just have Cognito do all these things.
‫Then, what are the required attributes to have?
‫So, right now we have email,
‫but we can also have address, birthdate,
‫family name and so on.
‫So, all these fields that we can require
‫of a user based on what you need for your application.
‫And then, you can add custom attributes.
‫So, what attributes it is?
‫For example, you want to have the favorite color
‫and then you will have it right here,
‫but right now we don't need it.
‫Okay, so next, what has happening for message delivery?
‫So, Cognito is going to uses SES for emails
‫and then is going to use SNS to send a messages,
‫SMS messages to your app users, okay?
‫So, you can either choose to send emails with SES
‫in which case you need to set up Amazons SES to send emails
‫and you need to have your own configuration sets.
‫Or you can send the emails with Cognito
‫in which case Cognito is going to be sending
‫the emails for you.
‫It's good for development purposes.
‫You can set up to 50 emails a day,
‫but for production,
‫you need to absolutely set up Amazon SES.
‫So right now we'll just have it as this.
‫Next, then, user pool name.
‫So, this is my DemoPool.
‫And then, do I want to use the hosted authentication pages?
‫So, this is pretty cool.
‫We'll see this in a second,
‫but it's a way for you to speed up your sign up
‫and signing flow because Cognito
‫will provide you a hosted UI
‫for you to use and for users to sign in and sign up.
‫So, yes, we want to use the Cognito hosted UI.
‫In the exam I want you to know that this thing exists, okay?
‫Then, you need to have a Cognito domain,
‫so what is the hosted URL?
‫So, this only appears if this is ticked.
‫So, we can use a custom domain
‫if you want to have your own URL or a Cognito domain,
‫so stephane-demo-cognito,
‫and we should be good to go.
‫.auth.eu-central-1.amazoncognito.com,
‫this is perfect.
‫Now, we have an initial app client,
‫so this is to configure a app,
‫which is an app that connects to user pool.
‫And so, we can have multiple app clients,
‫so we'll have a, first, app type.
‫So, this is a Public client where we can use
‫a public app to Cognito, but we can have a private client
‫or Other if you wanted to have more deep settings.
‫So, this one is just DemoAppClients
‫and do we want to generate client secrets, no.
‫Then, callbacks for the URL,
‫so these are like app specific stuff,
‫but basically this allows you
‫to connect your app to Cognito.
‫Okay, so we're good.
‫Next, so we need to have a callback URL,
‫so example.com.
‫And if I click on Next, I get an error
‫because I cannot use the word Cognito,
‫so just stephane-demo is going to work out.
‫Let's click on Next.
‫So, now, we can review everything that we have,
‫which was quite a lot of configuration, I know,
‫but we see many, many, many options.
‫And then, we create the user pool.
‫So, hopefully, this gives you a good overview
‫into what settings we have for user pool.
‫You can review this in your own time,
‫but once you have this,
‫you really start to understand the idea behind Cognito.
‫So, our DemoPool is not created,
‫but as you can see we have no users for now,
‫so we have to get started and create users.
‫To do so, let's go to App Integration.
‫We have set up our Cognito domain,
‫but if you try to open this in a new tab,
‫you're not gonna get anything but a blank page,
‫that's expected.
‫It's because to log in
‫you need to log in from an app perspective.
‫So we'll scroll down.
‫We actually have created an app as part of our create flow,
‫so let's click on the DemoAppClients.
‫We scroll down, we see that there is a hosted UI,
‫it's available.
‫We have defined the callback URL to be example.com
‫and what we're going to do
‫is that we're going to click on View Hosted UI.
‫From here, I'm able to create a new account
‫by doing a sign up.
‫Username is going to be Stephane,
‫the email is gonna be stephane@mailinator.com
‫and then the password is I'm going to use
‫a password that I know.
‫I sign up, don't save.
‫And then, I need to go to mailinator.com,
‫which is like a temporary email to go to the Stephane one
‫and I'm gonna check my mailbox.
‫And as you can see
‫I've received a verification code from Cognito.
‫So in here, I have the confirmation code here.
‫I can just copy it and paste it here,
‫confirm the account and my account is now confirmed.
‫And as you can see now, I am on example.com.
‫And example.com is the callback URL of my hosted UI,
‫which shows that after people are successfully logged in,
‫they go to the callback URL.
‫So you can make it whatever you want
‫for your application, of course.
‫And then, you can also customize the hosted UI,
‫so you can just click on, Use client-level settings.
‫You can upload a logo,
‫and for example I'm going to choose my beach.JPEG file.
‫Let's save the changes.
‫And if you go in here now back into the hosted UI,
‫as you can see, I get back the Example Domain
‫because I'm already logged in,
‫but if I copy this link right here,
‫open a private window and paste it.
‫As you can see now my login UI has been customized
‫and I have seen my beach.
‫But you can do a lot of things with this, actually.
‫You can edit this hosted UI
‫and you can add your own custom CSS file
‫to really customize everything there is in this UI,
‫which is very nice.
‫So now, if you go back into our pool, our DemoPool,
‫and we look at Users, we can see that, yes,
‫my user Stephane has been created, the email is verified,
‫and the status is confirmed, which is awesome.
‫You can also choose to manually create a user
‫if you wanted to, and send an email invitation,
‫enter username, email address, and so on.
‫So, it's one way, either users sign up on their own
‫or you sign them up from here.
‫You can group users together,
‫which is really good for security.
‫Also, what we can do is for the signing experience,
‫we can also have a federated identity provider.
‫So, I said before, you can do a Facebook, Google,
‫Amazon's Apple login or SAML or OIDC.
‫So for example, if I choose Google to have a Google login,
‫I have to enter the client ID of Google,
‫the Client's secret, the authorized scopes,
‫and as soon as this is done,
‫then my users will be able to do a Google login
‫and sign up for my page, which is very awesome.
‫Finally, let's have a look at a very important feature,
‫which is under, User pool properties,
‫you will find the Lambda triggers.
‫So, Lambda triggers allow you to react to things happening
‫within your user pool, and then you trigger Lambda function
‫and that allows you to build any kind
‫of integration you want.
‫For example, you may want to have a Lambda function
‫that it gets triggered whenever a user is signed up,
‫or whenever there is authentication,
‫or a custom authentication, or messaging and so on.
‫So for sign up, for example,
‫we have different trigger types.
‫You have the Pre-sign up trigger.
‫This is used to validate a user when they sign up
‫and then you customize their attributes,
‫or Post to send customized welcome messages
‫or log events for custom analytics,
‫or Migrate user when you are migrating a user
‫from another directory.
‫So, say you want to Pre-sign up trigger
‫to validate users because you wanna make sure,
‫I don't know, that the user
‫is also in your own internal database.
‫So to do so, you would create a Lambda function,
‫and then, Cognito would invoke it and you'd be good to go.
‫So this is very helpful and something that can come up
‫in the exam as well.
‫Have a look at Authentication.
‫Have a look at Custom and Messaging.
‫This can really help you understand the use cases
‫for Lambda triggers.
‫Okay, so that's it for this lecture.
‫We've seen a lots of things about Cognito user pools.
‫I hope you liked it,
‫and I will see you in the next lecture.