Serverless-stack-com: Comments: Cognito User Pool vs Identity Pool

[jayair]

Link to chapter - http://serverless-stack.com/chapters/cognito-user-pool-vs-identity-pool.html

[Pwntus]

Hi. Great guide!
I see that in the guide you're using a User Pool resource as authorizer.
This is good and all, but I was wondering what happens when you start federating multiple identities?
The use case would be to identify a single user "logging in" with multiple identity providers.

The sub claim used in the guide is only unique to the AWS User Pool, I suppose.

[jayair]

@Pwntus you are right the current guide is just for the User Pool. If there is enough interest; we might do one in the future for Federated Identities.

[geovanisouza92]

Am I right to think that User Pool stands for Authentication, as Identity Pool stands for Authorization?

[jayair]

@geovanisouza92 Hmm not quite. The User Pool is basically allowing AWS to store and manage all your users (they store it in their database and you access it through their SDK). And Identity Pool (or Federated Identities) is where you can bring your own identity providers (like FB or Google) and AWS created a unified user system for you.

[iwilsonq]

I'm building a project that started with this tutorial and we've been loving the features of the serverless stack. That said, I'm having a very hard time integrating Google and Facebook with Cognito. Does your team have any examples of this, where, we could have users signup/login with those providers or simply use Email/Password?

Ideally, after authenticating with Google/Facebook, we'd get back a userToken to authenticate against all requests to Lambda. Any help be greatly appreciated, the AWS docs have not been kind 😓

[jayair]

@iwilsonq Yeah I mentioned this elsewhere. It is a bit tricky to do and the docs aren't great. I think we might look into writing about this next. But you are creating a Cognito Identity Pool with Goole and Facebook as the Identity Providers and assign those users an IAM role. You then use that IAM role in the serverless.yml as the authorizer. Serverless Framework recently added support for this and it wasn't possible to do when we had first put this tutorial together.

[dbeja]

I was able to add Google/Facebook login using the federated user pool but I'm finding hard how do I clear the session or how do I check if user is logged in using the Identity pool.
Anyone found out how to do it?

Thanks!

[jayair]

@dbeja There isn't really a concept of logging in to the Identity Pool. We use the AWS JS SDK on the frontend to generate temporary credentials for a user pool authenticated user. And using these temporary credentials we are able to make calls to our AWS services.

When a user logs out we clear these credentials here - https://serverless-stack.com/chapters/clear-aws-credentials-cache.html

[dbeja]

Yes, but when I use an Identity Pool, instead of a Cognito User Pool, so that I can login with Facebook, I get my credentials in a different way (AWS.CognitoIdentityCredentials), so I don't have the object CognitoUserPool (because it's for a User Pool) and so I don't have the signout method.

What I need is to login on my application with social login and Identity Pool allows me to do that but I don't find anywhere how could I do the same you do on clearing the session or getting the current user using this instead.

[jayair]

@dbeja I know folks that have extended the tutorial to use social logins and we might cover it in the future. But if you are using a separate identity provider then you would need to use their SDK to get the user info and to clear the session.

[jayair]

This issue was moved to https://discourse.serverless-stack.com/t/comments-cognito-user-pool-vs-identity-pool/146