Identity and access for users: who is allowed in
A user directory with sign-up, sign-in, multi-factor and tokens, so your application, and the model behind it, only answer people you know.
What are authentication and authorisation?
Authentication proves who somebody is. Authorisation decides what that person may do once they are in. Nearly every application needs both, and an AI application needs them twice over: the same token that protects a page also protects the route to a model that costs money on every call.
Building it yourself is harder than it looks, every time. Password hashing, resets, multi-factor, bot defence, credential stuffing, and a set of standards that moves every year. A managed identity service does that part, so your time goes into the product instead of into login screens.
Four ways to run it
Each of the big clouds has a managed user directory, and there is a mature open one you can run yourself. The protocols are the same everywhere: OpenID Connect, OAuth 2.0 and SAML.
Amazon Cognito[1]
The user directory on AWS. A user pool handles sign-up, sign-in, multi-factor and federation and hands out JSON Web Tokens. An identity pool is the separate part that exchanges such a token for temporary AWS credentials.
Official documentation →Microsoft Entra External ID[2]
Microsoft's directory for the people outside your organisation, customers and partners. It is the successor to Azure AD B2C and sits next to the Entra tenant your employees already use.
Official documentation →Identity Platform[3]
The same engine as Firebase Authentication, sold with the controls a company asks for: multi-tenancy, audit logs and a support contract.
Official documentation →Keycloak[4]
The open identity server, backed by Red Hat and widely run in-house. It speaks the same protocols, so an application written against it can be pointed at a managed service later, and the other way round.
Project documentation →Where I used it
The video pipeline
The people who may start a render are the ones in the user pool. The token they get at sign-in is what the API checks before a job is allowed to cost anything, which is also the cheapest possible rate limit.
Read the write-up →Managed and self-hosted together: hybrid
Identity is the one piece people most often keep in-house, because the directory holds the names. The common shape is both: the company directory stays where it is, and the managed service federates to it, so the passwords never move and your application still only has to understand one token.
What would help you next?
Learn to decide
The course “From Managed to Hybrid” teaches where AI should run: what each layer costs, what you operate and where your data has to stay. It is in preparation, with a free live session first.
Linda MohamedAI and cloud consultant, AWS Community Hero, Vienna
Build it with me
Tell me what you want to build. In 30 minutes we check which of these ways fits your data, your rules and your budget, and whether AWS funding for a proof of concept can cover part of it. How AWS funding works →
You already know what you need
Book the workshop directly:
- AI Concept and Prototype workshops →
Architecture first, priced per service and tested on your data, then a prototype with a go or stop decision. - AI Discovery Workshop →
Sort your ideas into a scored shortlist, so you know which use case to build first.
Read more on ai-solutions.wiki
My open knowledge base, with longer comparisons, pricing notes and sources.
Sources
- Amazon Cognito documentation. https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html
- Microsoft Entra External ID documentation. https://learn.microsoft.com/en-us/entra/external-id/customers/overview-customers-ciam
- Google Cloud Identity Platform documentation. https://cloud.google.com/identity-platform/docs
- Keycloak documentation. https://www.keycloak.org/documentation
- Amazon Cognito, ai-solutions.wiki. https://ai-solutions.wiki/tools/amazon-cognito/
- Keycloak, ai-solutions.wiki. https://ai-solutions.wiki/tools/keycloak/
- Keycloak vs Cognito vs Azure AD B2C, ai-solutions.wiki. https://ai-solutions.wiki/comparisons/keycloak-vs-cognito-vs-azure-ad-b2c/
- Authentication and authorisation, ai-solutions.wiki. https://ai-solutions.wiki/glossary/authentication-and-authorization/
- OAuth, ai-solutions.wiki. https://ai-solutions.wiki/glossary/oauth/
Links checked October 2026. Product names and features change: check the linked pages before you decide.
