Robo Orders Pizza

Scene 1 · Sign-in for people

Who's at the door?

Before Robo can be sent anywhere, the party site has to know the person giving orders really is Ms. Rivera, the teacher. That starts at the sign-in desk.

1 Sign up at the front desk

Pick a password.

2 Get a wristband

Ms. Rivera signs in once. Instead of asking for her password at every door, the desk hands her wristbands.

3 Break the wristband

Edit it

Wait an hour

Wristbands are made to run out.

4 A guesser at the door

Someone wants Ms. Rivera's account and starts guessing passwords.

    What you just used

    Sign-in deskidentity provider (a "user pool")
    Code by emailverifying the contact address
    Fingerprintsalted password hash
    WristbandsID and access tokens
    Sealdigital signature on a JWT
    Public seal patternJWKS, the desk's public keys
    Pocket bandrefresh token
    Too many trieslockout, rate limiting
    Code from her phonemulti-factor authentication

    Who builds sign-in desks

    • Run your own with open-source Keycloak.
    • Built into each cloud: Amazon Cognito, Firebase Authentication, Microsoft Entra External ID.
    • Made for developer teams: Auth0, Clerk, and others.
    Connects to
    • Robo gets a job: the agent desk checks this same wristband before Robo acts for the teacher.
    • The staff roster: this desk is for visitors; staff sign in through the roster.
    Peek at a real sign-in desk

    This scene, for real, in Amazon Cognito: a desk opened, the teacher signed in, the seal checked with only Python's standard library, a forged wristband caught, a quiet renewal, a guesser locked out, and the desk closed afterwards. Tokens are never shown whole.

    # 1. Open a sign-in desk and register the teacher
   user pool us-east-1_<pool> (Lite plan), app client 'party-site'
   teacher ms.rivera@maplehill.example registered
   try a weak password 'pizza1' -> rejected: Password not long enough

# 2. She signs in and gets wristbands
   ID token: header {"alg": "RS256", "kid": "iBVads…"}
      claims {"token_use": "id", "email": "ms.rivera@maplehill.example", "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_<pool>"}
      lifetime 3600 seconds   signature X_uh_neYzT…
   access token: header {"alg": "RS256", "kid": "qU0AzW…"}
      claims {"token_use": "access", "scope": "aws.cognito.signin.user.admin", "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_<pool>"}
      lifetime 3600 seconds   signature Jbu8Gwvi7P…
   refresh token: 1778 characters, opaque (kept out of sight)

# 3. A room checks the seal on its own
$ curl https://cognito-idp.us-east-1.amazonaws.com/us-east-1_<pool>/.well-known/jwks.json
   2 public keys: RS256 kid iBVads…, RS256 kid qU0AzW…
   RS256 signature on the ID token, checked locally -> VALID

# 4. Edit the wristband
   email changed to principal@maplehill.example -> signature INVALID

# 5. Quiet renewal with the refresh token
   new ID token issued, no password typed -> signature VALID

# 6. Someone guesses passwords
   guess 1: Incorrect username or password.
   guess 2: Incorrect username or password.
   guess 3: Incorrect username or password.
   guess 4: Incorrect username or password.
   guess 5: Incorrect username or password.
   guess 6: Password attempts exceeded
   guess 7: Incorrect username or password.
   guess 8: Password attempts exceeded
   right after, even the real password: Password attempts exceeded

# 7. Close the desk
   deleted user pool us-east-1_<pool>

    Run it yourself: lab/front_door.py.

    Sign-in desk: 0/7