Aws-sdk-android: RFC - Auth workflows: improvements and additions

Created on 4 Jan 2019 · 14Comments · Source: aws-amplify/aws-sdk-android

We want to hear your feedback.

The AWSMobileClient, has simplified many authentication/authorization flows. We are extending AWSMobileClient to support additional use-cases outlined below:

As a developer I want to:

AWSMobileClient functionality:
1. ~Enable SAML based authorization~ released 2.12.5
2. ~Enable developer authenticated identities flow for authorization~ released 2.12.5
3. ~Use hosted UI from showSignIn API~ released 2.12.5
4. Add social buttons in drop-in UI that launches hosted UI for the selected social provider
5. ~Allow my end user to sign out of all devices~ released 2.12.5
6. ~Enable remember-device functionality~ released 2.12.5
Drop-in UI in AWSMobileClient functionality:
1. Disable sign up flow
2. Disable forgot password flow
3. Add custom input fields on the registration screen
4. Customize UI elements including font, background color, text color through colors.xml and style.xml
5. Enable localization
6. Switch text orientation from right to left instead of left to right (culture/language semantics)
7. Hide logo image / show sign in screen independently
8. Change the properties of logo - size, scale, fit, etc.
9. Directly show the sign-up screen
10. Directly show the change password screen
11. Create a custom main screen that can launch sign-in with Email, Google, Facebook
12. Lower the API level requirement to 15.

This issue will track the progress of this milestone. The following issues show the past feature requests we are taking into consideration.

We want to hear your feedback.

Please let us know which of the above use cases align with your requirements. Your feedback will help us prioritize the issues.

For example, if you want to use the styles.xml to customize the UI, please comment 2.4 or 2.iv.

In addition, please comment with your ideal workflow for your app. Additionally, the following are starting point questions to help guide your responses:

Are you using Cognito UserPools(authentication) and Cognito IdentityPools(authorization) both in your app?
Are you using drop-in UI in your app?
1. Do you want more functionality in drop-in UI or more/ easy-to-use APIs in AWSMobileClient to better provide functionality in your app UI?
2. Do you want to use drop-in UI as an onboarding mechanism and then move to your own UI before production _or_ use available customizations to match drop-in UI to your app theme?
3. How do you prefer to customize the drop-in UI? styles.xml or Java/Kotlin code?
Do you have social providers' authentication in your app?
1. How many social providers (and which) are part of your app?
Do you prefer native social providers' SDK(e.g. FBLoginSDK) or hosted solutions(CognitoAuth)?
How important is framework size?
Do you have more than 1 configuration for same resources in your app? (e.g. 2 UserPools for the same app based on region)

If you have a use-case which you want us to support in AWSMobileClient for authentication/ authorization use case, please comment below so that we can discuss and update this issue.

AWSMobileClient Cognito Feature Request

Source

minbi

👍6 🎉2

Most helpful comment

Hi team,

Is support for Cognito User Pool custom auth in AWSMobileClient on the roadmap?

Thanks.

Gringox on 7 May 2019

👍2

All 14 comments

What does the timeline look like for enabling using SAML based authorization?

Tjaub95 on 4 Jan 2019

Sorry, to fulfill my part of the bargain since you're soliciting feedback.

I've utilized Amplify within several web applications, and am now attempting to do so with Android.

Our application flow will be signing in immediately to one of the SSO providers, then making API calls with the assumed IAM role against API GW.

In our application we'll be using both a user pool and an identity pool in order to sign our users in and allow them to interact with our API GW endpoints.
In this case, we won't be using the drop-in UI because we'll be using SAML connections.
I don't have enough experience with the drop-in UI to answer this question
See 3
In this application, we will not
0
If I were utilizing social sign-ins I'd rather utilize their SDKs than the hosted UI.
Not at all
Not in this case.
Yes, we will have SAML federation in our applications. If the timeline of the aforementioned RFC is within reason I will not have to write my own implementation of SAML federation.
Device remembrance is not a high priority for our application.

My main need at the moment is SAML from the AWSMobileClient.

Tjaub95 on 4 Jan 2019

👍2

As a developer, I don't want to do any of the listed things (sorry about that).
I know I was the one that asked for developer authenticated federation, but after it wasn't around we decided to put everything through user pools. Unfortunately, this is leading to other issues, like #646

Here is my other feedback

Are you using Cognito UserPools(authentication) and Cognito IdentityPools(authorization) both in your app?

Cognito User Pools.

Are you using drop-in UI in your app?

No, as the minimum version would mean we lose 5% of our users (also, it doesn't seem to support Open ID Connect federation)

Do you want more functionality in drop-in UI or more/ easy-to-use APIs in AWSMobileClient to better provide functionality in your app UI?

No.

Do you want to use drop-in UI as an onboarding mechanism and then move to your own UI before production or use available customizations to match drop-in UI to your app theme?

No.

Do you have social providers authentication in your app?

Yes, Open ID Connect through Cognito User Pools, and eventually Facebook and Google

How many social providers (and which) are part of your app?

1 (at the moment)

Do you prefer native social providers' SDK(e.g. FBLoginSDK) or hosted solutions(CognitoAuth)?

I would like to use native providers, but that would not work in combination with Cognito User Pools.

How important is framework size?

Relatively important. <10MB would be nice.

Do you have more than 1 configuration for same resources in your app? (e.g. 2 UserPools for the same app based on region)

Our app is on a "whitelabel" basis, so we will most likely have 5+ pools.

Do you have SAML federation in your app?

No.

Do you have features to remember user device in your app?

Kind of. We don't want a user to login with more than one device on the same account.

andymartinwork on 14 Jan 2019

@andymartinwork,

Would you want to use the drop-in UI if it supported lower API versions? or are you saying you would rather write your own UI?

most likely have 5+ pools

Is this in the same app in when released? or do you have 5 versions of the app that may have 5 configurations?

minbi on 14 Jan 2019

Would you want to use the drop-in UI if it supported lower API versions? or are you saying you would rather write your own UI?

We would probably rather write our own UI anyway, as we need it to be very customised. But even if we did want to, 5% of our users are currently lower than 6.0. Our users are a bit more techy than usual, as the android dashboard says 25% of the global users are below 6.0

https://developer.android.com/about/dashboards/

Is this in the same app in when released? or do you have 5 versions of the app that may have 5 configurations?

We will have 5 versions of the app with 5 different configs, so it's easy for us to swap out the awsconfiguration.json file in our build step.

andymartinwork on 15 Jan 2019

👍1

2.i
2.v
2.vi
Disable email/password completely and only rely on Google

Are you using Cognito UserPools(authentication) and Cognito IdentityPools(authorization) both in your app?
Yes
Are you using drop-in UI in your app?
Yes
Do you want more functionality in drop-in UI or more/ easy-to-use APIs in AWSMobileClient to better provide functionality in your app UI?
Both
Do you want to use drop-in UI as an onboarding mechanism and then move to your own UI before production or use available customizations to match drop-in UI to your app theme?
drop in
Do you have social providers authentication in your app? Yes
How many social providers (and which) are part of your app? Google
Do you prefer native social providers' SDK(e.g. FBLoginSDK) or hosted solutions(CognitoAuth)?
Native
How important is framework size? 3/10
Do you have more than 1 configuration for same resources in your app? (e.g. 2 UserPools for the same app based on region) No
Do you have SAML federation in your app? No
Do you have features to remember user device in your app? No

ghost on 24 Jan 2019

👍1

Our initial use case was to use phone number registration (With OTP) and setup a password to recover or login to that account on another device. (As we do not want to recover with SMS OTP because the phone number might have been recycled to someone else)
Since this is simply not possible without custom sign in & recover server side code we decided to use social sign in using NATIVE SDK for Google, Facebook, Twitter but this prove to be very tricky to setup using AWS sdk (I haven't finished it yet, still trying to figure out how to do the federate login using the token from the third party)

We never need drop-in UI as we want a fully integrated UI which match our app style. (No webview's either)

Btw aws-android-sdk-auth-google should support lower than API 23+ (It should be 19 or 21) (We are min 21) but no matter the min sdk it is using deprecated code which requires the user to approve runtime permissions. The latest google sign-in doesn't do this anymore.

Shusshu on 31 Jan 2019

👍2

https://github.com/aws-amplify/aws-sdk-android/issues/685
Google auth works with user pools but not facebook.....

Shusshu on 8 Feb 2019

Edit: Add 2.xii Lower the API level requirement to 15.

minbi on 22 Feb 2019

Edit: SDK version 2.12.5 release; updated question list

minbi on 20 Mar 2019

Hi team,

Is support for Cognito User Pool custom auth in AWSMobileClient on the roadmap?

Thanks.

Gringox on 7 May 2019

👍2

Adding Manual Refresh of tokens to the list as requested in https://github.com/aws-amplify/aws-sdk-android/issues/696.

desokroshan on 12 Aug 2019

👍1

I would like to see Federated login implemented in the drop-in UI using the social SDKs. This would support rapid prototyping of apps to show clients. The clients all want social logins and they are used to seeing the social SDK login flows. You don't want to have to develop a custom authentication solution before the client is sold on the project. Start with a functioning drop-in supporting social SDKs and then you can start customizing things.

Some of the above comments are from people who are in the custom auth flow stage of development. I would not expect those developers to switch back to the drop-in UI.

I also find the documentation to be quite confusing.
This page tells you how to build a social UI...
https://docs.aws.amazon.com/en_pv/aws-mobile/latest/developerguide/mobile-hub-add-aws-mobile-user-sign-in.html
But those instruction don't reconcile with this page...
https://aws-amplify.github.io/docs/android/authentication

To figure things out I had to read the source code in the android SDK which led me to this issue. Now I see the SDK lets me build a social UI, but there is no simple way to get it functioning. There needs to a way for someone to get a social auth page running without a month's worth of work.