AWS cognito: Document Cognito step-up authentication scenario
Summary
Adds a step-up authentication scenario describing how an application checks the acr claim and requires MFA for a sensitive banking operation.
Security assessment
Documents step-up authentication and MFA enforcement for sensitive operations by checking acr/auth_time claims, which is authentication security guidance.
Evidence
+Consider a banking application that lets users sign in with a username and password. To make a wire transfer, the application requires multi-factor authentication (MFA). When a user attempts a transfer, the application inspects the `acr` claim in the user's access and ID tokens, determines that the authentication level is insufficient, and redirects the user to Amazon Cognito to complete MFA. Amazon Cognito then issues a new token with an elevated authentication level, and the application allows the transfer.
Diff
diff --git a/cognito/latest/developerguide/cognito-scenarios.md b/cognito/latest/developerguide/cognito-scenarios.md index d27b0d2..d822a3d 100644 --- a//cognito/latest/developerguide/cognito-scenarios.md +++ b//cognito/latest/developerguide/cognito-scenarios.md @@ -7 +7 @@ -Authenticate with a user poolAccess server-side resourcesAccess resources with API Gateway and LambdaAccess AWS services with a user pool and an identity poolAuthenticate with a third party and access AWS services with an identity poolAccess AWS AppSync resources with Amazon CognitoMachine-to-machine (M2M) +Authenticate with a user poolAccess server-side resourcesAccess resources with API Gateway and LambdaAccess AWS services with a user pool and an identity poolAuthenticate with a third party and access AWS services with an identity poolAccess AWS AppSync resources with Amazon CognitoMachine-to-machine (M2M)Step-up authentication @@ -34,0 +35,2 @@ With an identity pool, your users can obtain temporary AWS credentials to access + * Step-up authentication + @@ -93,0 +96,8 @@ To enable M2M authorization, build an app client that has a client secret, and e +## Step-up authentication + +Consider a banking application that lets users sign in with a username and password. To make a wire transfer, the application requires multi-factor authentication (MFA). When a user attempts a transfer, the application inspects the `acr` claim in the user's access and ID tokens, determines that the authentication level is insufficient, and redirects the user to Amazon Cognito to complete MFA. Amazon Cognito then issues a new token with an elevated authentication level, and the application allows the transfer. + +Before you redirect a user to Amazon Cognito for step-up authentication, evaluate the tokens that your application already holds. Compare the `auth_time` claim to the maximum age that the operation allows, and compare the token's `acr` level to the level that the operation requires. Redirect the user to Amazon Cognito to complete the authentication flow only when the required authentication level or freshness isn't already met. + +For more information about ACR levels, AMR values, and other step-up authentication concepts, see [Authentication levels with ACR and AMR claims](./cognito-user-pools-step-up-authentication.html). For the mechanics of requesting step-up authentication, see [Step-up authentication with the USER_AUTH flow](./authentication-flows-selection-sdk.html#cognito-user-pools-step-up-user-auth) for the `USER_AUTH` flow, and [Authorize endpoint](./authorization-endpoint.html) and [Login endpoint](./login-endpoint.html) for managed login. +