CSC510 Lecture 21

Cognito
(20261019)

Transcript

1. CSC 5100 Modern Software Engineering Lecture 21. Amazon Cognito Dr. Javier Gonzalez-Sanchez javiergs@calpoly.edu www.javiergs.phd ffi o ce: 14 -227
5. Strategies CLAUDE DESKTOP CLAUDE DESKTOP MCP over stdio MCP over HTTPS CloudMcpServer.java Java MCP SDK HttpClient REST → LAMBDA API Gateway 5 a TemperatureLambda Loc l Bridge AWS AGENTCORE GATEWAY Managed MCP endpoint REST → LAMBDA Same API Gateway Same
6. Amazon Cognito A detour before Bedrock AgentCore
7. Cognito in our architecture We protect a NEW route, leaving the original course endpoint unchanged.
8. Two different questions Authentication and authorization are not synonyms. Authentication Authorization Who are you? Are you allowed? Cognito checks credentials and issues tokens. API Gateway validates the token and controls access.
9. Our local MCP server worked Authentication is the next question. Claude Desktop CloudMcpServer.java TemperatureLambda MCP over stdio Java MCP SDK API Gateway tools/list HTTP client GET /5100/temperature tools/call
10. The problem: our REST API is public Anyone who knows the URL can call the existing endpoint. GET /5100/temperature?value=86&from=F&to=C HTTP 200 { "value": 86.0, "from": "F", "to": "C", "result": 30.0 } Question: How do we require a user to sign in first?
11. Instructor setup Cognito One User Pool API Gateway Result New protected GET route Protected URL Public app client (no secret) Cognito authorizer Individual student accounts Same TemperatureLambda
12. Java dependency Cognito Identity Provider is a separate AWS SDK module. <dependency> <groupId>software.amazon.awssdk</groupId> <artifactId>cognitoidentityprovider</artifactId> <version>${aws.sdk.version}</version> </dependency> Use the same AWS SDK v2 version management as our previous Lambda exercises. 7
13. Java: authenticate with Cognito CognitoIdentityProviderClient cognito = CognitoIdentityProviderClient.builder() .region(Region.US_WEST_2) .build();
15. Java: authenticate with Cognito private String authenticate(String username, String password) { InitiateAuthResponse response = cognito.initiateAuth ( InitiateAuthRequest.builder().clientId(clientId) .authFlow(AuthFlowType.USER_PASSWORD_AUTH) .authParameters(Map.of( "USERNAME", username, "PASSWORD", password )) .build() ); return response.authenticationResult().accessToken(); }
16. Why Cognito? We already have a REST API. Who is allowed to call it? Before After Keep Lambda unchanged GET /5100/temperature GET /5100/temperaturesecure API Gateway checks identity before invoking the same Lambda No authentication required Authorization: Bearer <JWT>
17. Amazon Cognito
19. User Pool vs. App Client Two different AWS resources with different responsibilities User Pool App Client Directory of users Defines how an application signs in Credentials, password policy, MFA, account recovery Authentication flows, client ID, optional secret Example: CSC5100-Java Example: CSC5100 One User Pool can serve several app clients (Java, web, mobile).
20. Choose an application type AWS Console asks how the application will run Traditional web Server-side application Often uses confidential client credentials SPA Mobile (Single-Page Application) Machine-tomachine Installed app Service-to-service Public client; no embedded secret Client credentials; no human login Browser app Public client; no client secret Our classroom choice: SPA as a convenient way to create a public app client for Java.
21. Step 2. Con igure the App Client 21 f • Cognito → User Pools → CSC5100 → App clients
22. Authentication flows The app client must allow the flow used by our Java code Username and password Secure remote password Choice-based sign-in Existing session ALLOW_USER_PA SSWORD_AUTH SRP protocol avoids sending the raw password as a direct auth parameter. Cognito can present or negotiate available sign-in methods. USER_AUTH session-related token acquisition / refresh behavior, depending on flow. Our InitiateAuth example uses this.
23. 1. Create a JWT Authorizer Cognito authenticates; API Gateway enforces access Type: JWT Name: CSC5100-Cognito Identity source: $request.header.Authorization Issuer: https://cognito-idp.us-west-2.amazonaws.com/<USER_POOL_ID> Audience: Cognito App Client ID (CSC5100-Java)
24. 2. Create a Protected Route Ataching an Authorizer Cognito authenticates; API Gateway enforces access Routes → Create → GET /5100/temperature-secure Integration: Existing TemperatureLambda Keep GET /5100/temperature public. Attach the Authorizer Authorization → Attach authorizers to routes Select GET /5100/temperature-secure Authorizer: CSC5100-Cognito
25. Test Cognito before MCP CognitoTest.java is a standalone Java program Inputs Success Failure cases COGNITO_CLIENT_ID Authentication successful! Wrong password COGNITO_USERNAME JWT received: true Unsupported flow COGNITO_PASSWORD Password change / MFA challenge
26. Next Back to MCP But not Limited to It
28. Takeaway :: before AgentCore The authentication pattern is reusable. Cognito Java client API Gateway Authenticates a person Obtains token Validates token Issues signed access tokens Sends Bearer token Invokes existing Lambda Next: AgentCore Gateway protects remote MCP calls with a related OAuth/JWT flow.
29. Questions 29
30. CSC 5100 Modern Software Engineering Javier Gonzalez-Sanchez, Ph.D. javiergs@calpoly.edu Fall 2026 Copyright. These slides may be used only as study material for CSC 5100 within the California State University system. They may not be distributed or used for any other purpose.