A scenario that uses FIDO as a second factor (with password).A scenario that uses FIDO as the only factor (password-less).To help with implementation details, I created a project to demonstrate WebAuthn integration with Amazon Cognito that provides sample code for three scenarios: This blog post and the diagrams below explain a scenario that uses FIDO as the only authentication factor, to implement password-less authentication. This combination provides a more secured authentication flow that uses stronger credentials, protects user from phishing and provides better user experience. In this password-less flow, the private key has never left the physical device, the authenticator also validates that relying party in authentication request matches the relying party that was used to create the credentials. Response from the authenticator is then passed as a challenge response to Amazon Cognito and verified using the stored public key. The application prompts the user to sign in using the authenticator that they used during registration.

The private key of this credential set remains on the authenticator, the public key, together with a credential identifier are saved in a custom attribute that’s part of the user profile in Amazon Cognito.ĭuring authentication, a Cognito custom authentication flow will be used to implement authentication through a custom challenge. For example, a platform authenticator with a biometric sensor or a roaming authenticator like a physical security key. You can then validate these credentials during the authentication phase in a custom challenge.ĭuring registration, a new set of credentials that are bound to your application (relying party), are created through a FIDO authenticator. To use this flow to implement FIDO authentication, you need to create credentials during the registration phase and reference these credentials in the user’s profile. You can use this flow to implement password-less authentication that is based on custom challenges. How it worksĪmazon Cognito user pools allow you to build a custom authentication flow that uses AWS Lambda functions to authenticates users based on one or more challenge/response cycles. To learn more about the flow of WebAuthn and CTAP, visit the FIDO Alliance. Mobile and web applications can use WebAuthn together with browser and device support for the Client-To-Authenticator-Protocol (CTAP) to implement Fast ID Online (FIDO) authentication. Using public-key cryptography enables you to implement a stronger authentication mechanism that’s less dependent on passwords. Web Authentication (WebAuthn) is a W3C standard that lets users authenticate to web applications using public-key cryptography. To do this, you’ll allow physical security keys or platform authenticators (like finger-print scanners) to be used as the authentication factor to your web or mobile applications that use Amazon Cognito user pools for authentication.Īn Amazon Cognito user pool is a user directory that Amazon Web Services (AWS) customers use to manage their customer identities. In this blog post, I show you how to offer a password-less authentication experience to your customers.

1password mfa aws