SaaS authentication: Identity management with Amazon Cognito user pools

This article discusses different approaches to handle identity management and multi-tenancy in SaaS applications using Amazon Cognito user pools.

Specifically, the article covers:

• An overview of Amazon Cognito and the types of tokens it issues (ID, access, and refresh tokens)
• Five patterns for representing SaaS identity with Cognito:
  1. Using custom attributes to represent tenant context
  2. Shared user pool (pool model)
  3. Group-based multi-tenancy (pool model)
  4. Dedicated user pool per tenant (silo model)
  5. Application client per tenant (bridge model)
• Advantages and disadvantages of each pattern
• Conclusion highlighting the need to evaluate requirements and adopt a hybrid model if needed