Need advice about which tool to choose?Ask the StackShare community!
Amazon Cognito vs Spring Security: What are the differences?
Introduction
This markdown code provides a comparison between Amazon Cognito and Spring Security, highlighting the key differences between the two.
Data Storage: A significant difference between Amazon Cognito and Spring Security is their approach to data storage. Amazon Cognito utilizes the Amazon Web Services (AWS) stack to store user data securely in the cloud, providing scale and resilience for managing user accounts and data. On the other hand, Spring Security does not provide a dedicated data storage solution but rather integrates with existing databases or user repositories through its flexible architecture.
Authentication and Authorization: Amazon Cognito offers built-in authentication and authorization mechanisms, supporting popular social identity providers, such as Facebook, Google, and Amazon. It provides a fully managed user directory, enabling features like user sign-up, sign-in, and multi-factor authentication. Spring Security, on the other hand, is primarily focused on providing security capabilities for Java applications and can integrate with various authentication mechanisms, such as LDAP, JDBC, and OAuth. It provides a comprehensive framework for role-based authorization through its security configuration.
Scalability and Serverless Computing: With Amazon Cognito, developers can take advantage of the scalability and serverless computing capabilities provided by AWS. It can handle millions of users and automatically scales to accommodate varying user loads. Spring Security, on the other hand, relies on the underlying application infrastructure for scalability and may require additional configuration or resources to handle large user bases effectively.
Integration with AWS Services: Amazon Cognito seamlessly integrates with other AWS services, such as Amazon API Gateway, AWS Lambda, and Amazon S3, allowing developers to build secure and scalable serverless applications. It can provide access to AWS resources based on user roles and permissions. Spring Security, while not directly integrated with AWS services, can be used in conjunction with them through appropriate configurations and libraries.
Vendor Lock-in: Amazon Cognito, being an AWS service, may introduce some level of vendor lock-in as it is tightly coupled with the AWS ecosystem. While it offers a wide range of functionality and convenience for AWS-based applications, migrating to a different cloud provider may require significant effort. Spring Security, being an open-source framework, provides more flexibility and can be used with various cloud platforms or self-hosted environments without significant vendor lock-in concerns.
Pricing Model: Another key difference between Amazon Cognito and Spring Security is their pricing models. Amazon Cognito follows a pay-as-you-go pricing model, charging for active users and the amount of data stored. The pricing includes both authentication and authorization services. Spring Security, on the other hand, is an open-source framework and does not have any direct costs associated with it, making it a cost-effective option for applications that do not require the additional features provided by Amazon Cognito.
In summary, Amazon Cognito and Spring Security differ in their approach to data storage, authentication and authorization mechanisms, scalability, integration with AWS services, vendor lock-in, and pricing models.
I am working on building a platform in my company that will provide a single sign on to all of the internal products to the customer. To do that we need to build an Authorisation server to comply with the OIDC protocol. Earlier we had built the Auth server using the Spring Security OAuth project but since in Spring Security 5.x it is no longer supported we are planning to get over with it as well. Below are the 2 options that I was considering to replace the Spring Auth Server. 1. Keycloak 2. Okta 3. Auth0 Please advise which one to use.
It isn't clear if beside the AuthZ requirement you had others, but given the scenario you described my suggestion would for you to go with Keycloak. First of all because you have already an onpremise IdP and with Keycloak you could maintain that setup (if privacy is a concern). Another important point is configuration and customization: I would assume with Spring OAuth you might have had some custom logic around authentication, this can be easily reconfigured in Keycloak by leveraging SPI (https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi). Finally AuthZ as a functionality is well developed, based on standard protocols and extensible on Keycloak (https://www.keycloak.org/docs/latest/authorization_services/)
We have good experience using Keycloak for SSO with OIDC with our Spring Boot based applications. It's free, easy to install and configure, extensible - so I recommend it.
You can also use Keycloak as an Identity Broker, which enables you to handle authentication on many different identity providers of your customers. With this setup, you are able to perform authorization tasks centralized.
I started our team on Amazon Cognito because I was a Solutions Architect at AWS and found it really easy to follow the tutorials and get a basic app up and running with it.
When our team started working with it, they very quickly became frustrated because of the poor documentation. After 4 days of trying to get all the basic passwordless auth working, our lead engineer made the decision to abandon it and try Auth0... and managed to get everything implemented in 4 hours.
The consensus was that Cognito just isn't mature enough or well-documented, and that the implementation does not cater for real world use cases the way that it should. I believe Amplify has made some of this simpler, but I would still recommend Auth0 as it's been bulletproof for us, and is a sensible price.
Pros of Amazon Cognito
- Backed by Amazon14
- Manage Unique Identities7
- Work Offline4
- MFA3
- Store and Sync2
- Free for first 50000 users1
- It works1
- Integrate with Google, Amazon, Twitter, Facebook, SAML1
- SDKs and code samples1
Pros of Spring Security
- Easy to use3
- Java integration3
Sign up to add or upvote prosMake informed product decisions
Cons of Amazon Cognito
- Massive Pain to get working4
- Documentation often out of date3
- Login-UI sparsely customizable (e.g. no translation)2
- Docs are vast but mostly useless1
- MFA: there is no "forget device" function1
- Difficult to customize (basic-pack is more than humble)1
- Lacks many basic features1
- There is no "Logout" method in the API1
- Different Language SDKs not compatible1
- No recovery codes for MFA1
- Hard to find expiration times for tokens/codes1
- Only paid support1