Developer Preview of AWS SDK for JavaScript in the Browser

How does this generate security credentials for a user client side? It mentions Identity Federation[1], but it looks like that links with Google , Facebook, or Login with Amazon. Is there a way to to authenticate a user without a 3rd-party login service?

[1] http://aws.typepad.com/aws/2011/08/aws-identity-and-access-m...

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#5

Post by williamcotton » Thu, Oct 31, 2013, 5:49 PM UTC

superfresh wrote: post #4

How does this generate security credentials for a user client side? It mentions Identity Federation[1], but it looks like that links with Google , Facebook, or Login with Amazon. Is there a way to to authenticate a user without a 3rd-party login service? [1] http://aws.typepad.com/aws/2011/08/aws-identity-and-access-m...

I really apologize for a very cursory read on my part, but I'm guessing it is in the same manner that CORS uploads to S3 is handled: http://aws.amazon.com/articles/1434/

There seems to be more details here: http://aws.typepad.com/aws/2013/05/aws-iam-now-supports-amaz...

Again, I didn't have time to read all of this and see if it is done in the same manner as has been possible with S3/CORS for the last year or so.

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#6

Post by recuter » Thu, Oct 31, 2013, 5:54 PM UTC

"Each request must be signed with your AWS credentials. .. Our web identify federation feature to authenticate the users of your application. By incorporating WIF into your application, you can use a public identity provider (Facebook, Google, or Login with Amazon) to initiate the creation of a set of temporary security credentials." http://media.amazonwebservices.com/blog/2013/iam_web_identit...

I rather disagree with getting your autherization tokens by the grace of Google and Facebook.

It seems simple enough to roll your own, perfect use case for App Engine actually:

(Gets temp S3keys)

User Logins to your site (AppEngine)

ˇ

S3

I just wish Amazon offered better late rimiting options and intergration behind the scenes. The 'Each Request' phrasing can be misleading, you don't need to sign each request, you can give the client side app a token that will last for an hour or a week. (But its on you to refresh it when it expires and keep track of how its being used so there's no abuse)

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#7

Post by superfresh » Thu, Oct 31, 2013, 5:54 PM UTC

williamcotton wrote: post #5

superfresh wrote: post #4

How does this generate security credentials for a user client side? It mentions Identity Federation[1], but it looks like that links with Google , Facebook, or Login with Amazon. Is there a way to to authenticate a user without a 3rd-party login service? [1] http://aws.typepad.com/aws/2011/08/aws-identity-and-access-m...

I really apologize for a very cursory read on my part, but I'm guessing it is in the same manner that CORS uploads to S3 is handled: http://aws.amazon.com/articles/1434/ There seems to be more details here: http://aws.typepad.com/aws/2013/05/aws-iam-now-supports-amaz... Again, I didn't have time to read all of this and see if it is done in the same manner as has been possible with S3/CORS for the last year or so.

Ah ok yeah that makes sense. Pre-generate a signed token and post it along with the form. I guess in that case you wouldn't even need the jS-SDK since you can just do a normal POST/PUT to the s3 bucket with those credentials. I guess I got excited only to realize nothing would change ;)

Thanks for your help!

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#8

Post by sha90 » Thu, Oct 31, 2013, 5:54 PM UTC

superfresh wrote: post #4

How does this generate security credentials for a user client side? It mentions Identity Federation[1], but it looks like that links with Google , Facebook, or Login with Amazon. Is there a way to to authenticate a user without a 3rd-party login service? [1] http://aws.typepad.com/aws/2011/08/aws-identity-and-access-m...

An application can provide a server-side component that vends credentials to clients. Mobile applications on AWS used to do this with the Token Vending Machine[1]. I say used to because web identity federation is a much more powerful and lightweight way to vend credentials. Instead of hosting your own auth backend, you can offload that to another identity provider like Login With Amazon, Google, or Facebook.

Certainly, though, if you want total control of your own auth, you can still use the TVM or something like it to get credentials into your application. It does require that you are running a backend server though, which the client-side JS is meant to remove.

[1] http://aws.amazon.com/articles/4611615499399490

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#9

Post by sha90 » Thu, Oct 31, 2013, 5:59 PM UTC

williamcotton wrote: post #5

superfresh wrote: post #4

How does this generate security credentials for a user client side? It mentions Identity Federation[1], but it looks like that links with Google , Facebook, or Login with Amazon. Is there a way to to authenticate a user without a 3rd-party login service? [1] http://aws.typepad.com/aws/2011/08/aws-identity-and-access-m...

I really apologize for a very cursory read on my part, but I'm guessing it is in the same manner that CORS uploads to S3 is handled: http://aws.amazon.com/articles/1434/ There seems to be more details here: http://aws.typepad.com/aws/2013/05/aws-iam-now-supports-amaz... Again, I didn't have time to read all of this and see if it is done in the same manner as has been possible with S3/CORS for the last year or so.

If your application is only using S3 to upload objects, the full SDK would probably be overkill. Using pre-signed forms is sufficient there. However, if you want to use other services like DynamoDB, SQS, or SNS, pre-signed URLs will not work. Also note that in order to generate a pre-signed URL you still need a backend service running to sign those URLs, something you can avoid with the client-side SDK.

Re: Developer Preview of AWS SDK for JavaScript in the Browser

#10

Post by _pius » Thu, Oct 31, 2013, 6:04 PM UTC

This is huge. Jeff, if you're still reading, are there any plans to include Persona in the Web Identity federation?