3 ms·

Azure also has Azure AD, thus first class support for user and app identity. Cognito isn't even close.

by pid-1 4y ago

robertlagrant 4y ago
What does Cognito lack?
- mooreds 4y ago
  Oh so much. We hear this from our users all the time. Full disclosure, I work for a Cognito competitor, so I'm definitely talking my book here. But our users are not. Here's a summation. * There is only one deployment model, a SaaS offering on AWS. * The user pool and identity pool concepts can be difficult to grasp. * The user interface presented to your customers is inflexible and hard to customize. * You can run Cognito only in the geographies supported by AWS. * Cognito pools are not multi-region. If the AWS region that your pool is in is unavailable, you have few options. * It doesn’t support localization of messages or the user interface. * You can’t backup or export all user data, notably password hashes. * SAML accounts are expensive after you grow beyond the free tier. * Possibly most concerning, Amazon Cognito has been relatively static and has received few recent improvements over the last few years. The console UX got an overhaul in 2021, though. * The customizability of the user interface and workflows are lacking. * Since you can't export your password hashes, if you move to a different provider, you have to reset user passwords or use a drip migration. Here's a funny video from Corey Quinn about Cognito: https://www.youtube.com/watch?app=desktop&v=x70EypnAH1Y&feature=youtu.be https://www.youtube.com/watch?app=desktop&v=x70EypnAH1Y&feat... That said, I've heard rumors they are working on multi-region Cognito (see this vague tweet from an AWS employee: https://twitter.com/sarah_cecc/status/1486346455790985228 https://twitter.com/sarah_cecc/status/1486346455790985228 ) which would absolutely be a game changer. And they have a nice serverless model if you can get by with their functionality and deployment model.
  - wizwit999 4y ago
    #1 make no sense as a criticism of an AWS service, thats true (and the point) of all AWS services (excluding services on Outposts but that's not used casually).
    - mooreds 4y ago
      Agreed that #1 is due to it being an AWS service. There are a number of issues with Cognito that are shared with other AWS services. That doesn't necessarily disqualify Cognito for all situations. But certain auth providers (including my employer, but also many other solutions) can be deployed elsewhere (in other clouds, on-prem, etc).
  - robertlagrant 4y ago
    Hm thanks. I suppose I wasn't so clear as to say "vs Azure AD", which I was really after. But that is also a useful summary for thinking more generally about auth! I guess Azure AD would at least have the same restrictions on deployment, but restricted to Azure regions instead (IIRC Azure AD B2C only has 4 regions globally, although I may be out of date.)
    - mooreds 4y ago
      Ah, did you want to compare it to Azure AD or Azure AD B2C? As you allude to, they are different solutions aimed at different spaces (IAM vs CIAM). I'm less familiar with Azure AD B2C than with Cognito, but from my research and tinkering, Azure AD B2C has similar limits on UX customizability (basically CSS was the only way to change the look and feel when I checked it out), but more flexibility around workflows, using custom policies: https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-overview https://docs.microsoft.com/en-us/azure/active-directory-b2c/... Azure AD B2C wins on pricing (no SAML surcharge, I believe and the per MAU beats Cognito's until you get to 10M users for p1), but, as you'd expect, is less straightforward. As far as regions/availability, I couldn't find a straightforward answer. This: https://docs.microsoft.com/en-us/azure/active-directory-b2c/data-residency https://docs.microsoft.com/en-us/azure/active-directory-b2c/... indicates you can choose one of 4 places to store user data, but it isn't clear to me if there are multiple regions/data centers that apply if you choose, say, France. Cognito's availability story is much clearer.

Azure also has Azure AD, thus first class support for user and app identity. Cognito isn't even close.

by pid-1 4y ago

Azure also has Azure AD, thus first class support for user and app identity. Cognito isn't even close.

robertlagrant 4y ago

What does Cognito lack?

mooreds 4y ago
Oh so much. We hear this from our users all the time. Full disclosure, I work for a Cognito competitor, so I'm definitely talking my book here. But our users are not. Here's a summation. * There is only one deployment model, a SaaS offering on AWS. * The user pool and identity pool concepts can be difficult to grasp. * The user interface presented to your customers is inflexible and hard to customize. * You can run Cognito only in the geographies supported by AWS. * Cognito pools are not multi-region. If the AWS region that your pool is in is unavailable, you have few options. * It doesn’t support localization of messages or the user interface. * You can’t backup or export all user data, notably password hashes. * SAML accounts are expensive after you grow beyond the free tier. * Possibly most concerning, Amazon Cognito has been relatively static and has received few recent improvements over the last few years. The console UX got an overhaul in 2021, though. * The customizability of the user interface and workflows are lacking. * Since you can't export your password hashes, if you move to a different provider, you have to reset user passwords or use a drip migration. Here's a funny video from Corey Quinn about Cognito: https://www.youtube.com/watch?app=desktop&v=x70EypnAH1Y&feature=youtu.be https://www.youtube.com/watch?app=desktop&v=x70EypnAH1Y&feat... That said, I've heard rumors they are working on multi-region Cognito (see this vague tweet from an AWS employee: https://twitter.com/sarah_cecc/status/1486346455790985228 https://twitter.com/sarah_cecc/status/1486346455790985228 ) which would absolutely be a game changer. And they have a nice serverless model if you can get by with their functionality and deployment model.
- wizwit999 4y ago
  #1 make no sense as a criticism of an AWS service, thats true (and the point) of all AWS services (excluding services on Outposts but that's not used casually).
  - mooreds 4y ago
    Agreed that #1 is due to it being an AWS service. There are a number of issues with Cognito that are shared with other AWS services. That doesn't necessarily disqualify Cognito for all situations. But certain auth providers (including my employer, but also many other solutions) can be deployed elsewhere (in other clouds, on-prem, etc).
- robertlagrant 4y ago
  Hm thanks. I suppose I wasn't so clear as to say "vs Azure AD", which I was really after. But that is also a useful summary for thinking more generally about auth! I guess Azure AD would at least have the same restrictions on deployment, but restricted to Azure regions instead (IIRC Azure AD B2C only has 4 regions globally, although I may be out of date.)
  - mooreds 4y ago
    Ah, did you want to compare it to Azure AD or Azure AD B2C? As you allude to, they are different solutions aimed at different spaces (IAM vs CIAM). I'm less familiar with Azure AD B2C than with Cognito, but from my research and tinkering, Azure AD B2C has similar limits on UX customizability (basically CSS was the only way to change the look and feel when I checked it out), but more flexibility around workflows, using custom policies: https://docs.microsoft.com/en-us/azure/active-directory-b2c/user-flow-overview https://docs.microsoft.com/en-us/azure/active-directory-b2c/... Azure AD B2C wins on pricing (no SAML surcharge, I believe and the per MAU beats Cognito's until you get to 10M users for p1), but, as you'd expect, is less straightforward. As far as regions/availability, I couldn't find a straightforward answer. This: https://docs.microsoft.com/en-us/azure/active-directory-b2c/data-residency https://docs.microsoft.com/en-us/azure/active-directory-b2c/... indicates you can choose one of 4 places to store user data, but it isn't clear to me if there are multiple regions/data centers that apply if you choose, say, France. Cognito's availability story is much clearer.