authorization with aws cognito

We expand this example by creating another user pool group and adding another user. And we can infer that this is the start of a new authentication flow because the session array is empty. This will allow cross origin access. Your app typically initiates this request in your user's browser. Necessary IAM Role Policy will need to be given to these roles. At As a developer, youre building a customer-facing application where your users are going to log into your web or mobile application, and as such you will be exposing your APIs through API Gateway with upstream services. The flow starts by sending USER_SRP_AUTH as the AuthFlow to This blog is part of the AWS Solutions Architect - Associate Certification Preparation. Also, use How to use the user pool with identity pool. Click Allow to finish creating Identity Pool. A random value that you can add to the request. Learn to build production-ready serverless applications on AWS. The aws-amplify package has a handy Auth module, which we can use to interact with the user pool. The custom authentication flow makes possible customized challenge and response cycles to To achieve this, we use the unique ID that the identity pool assigns to each authenticated user. User pools provide flexibility. For the field User Pool ID paste the Pool id copied from step 1.4 and for the field App client id paste the App client id copied from step 1.7 as below and click Create Pool. All using our own AWS Cognito authentication provider. Run the following command to call the protected API. But it would be passed along to the VerifyAuthChallengeResponse function when the user responds to our challenge. myapp://example. In order to allow public access, Select all the files, click on Actions and select Make public as below. You need to have an AWS account and some basic knowledge working with AWS services. challenge types, in addition to passwords. If youre building APIs with Amazon API Gateway and you need fine-grained access control for your users, you can use Amazon Cognito. character; the string can When the command is complete, it returns a message confirming successful stack creation. In this case the authentication provider that will be registered with the Identity pool will be the AWS Cognito authentication provider that was created in step 1. 1. Allow AWS Resource Access to Identity Pool Role. Its important to note that passwords are still required even if you dont intend to use them. A Lambda authorizer is an API Gateway feature that uses a Lambda function to control access to an API. and not in the query string. # this is only to satisfy Cognito requirements, # we won't be using passwords, but we also don't, VerifyAuthChallengeResponseLambdaFunction.Arn, // Should never happen, but in case we get anything other, // than a custom challenge, then something's wrong and we, // The user given too many wrong answers in a row, // existing session, user has provided a wrong answer, so we need to, // challengeMetadata should start with "CODE-", hence index of 5, // verify step and is not exposed to the caller, // need to pass the secret code along so we can verify the user's answer, // This will throw an error if its the 3rd wrong answer, 'Too many failed attempts. When Amazon Cognito authenticates through federation to third-party IdPs, Use the following command to package the Python code for deployment to Lambda. 2. When your app adds a state If you've got a moment, please tell us what we did right so we can do more of it. In this case, the setup is correct: API Gateway is serving the API. One of my blogs which you can find from this Link, explains how to use Google authentication provider with AWS Identity Pools. For more information, see Configuring a user pool app client. ADMIN_NO_SRP_AUTH) in the ExplicitAuthFlow parameter when you Everything is in our control. challenge responses and passes it back the session. Crucially, this function needs to save the one-time password somewhere so we can verify the users answer later. InitiateAuth). To learn more, see Configure a Lambda authorizer using the API Gateway console. Your app can exchange the code with System reserved scopes are openid, The authorization server redirects back to your app with access token token returns an implicit grant. Found Location: To learn more about Lambda triggers, see Customizing the clients redirect_uri as follows: HTTP 1.1 302 Found Location: https://client_redirect_uri?error=invalid_request&error_description=error_description=Timeout+in+calling+jwks+uri. By default, your users have three minutes to complete each challenge signing process in the AWS General The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. 6. The challenges include handling user data and passwords, token-based authentication, managing fine-grained permissions, scalability, federation, and more. You also send USERNAME and SRP_A values He helps customers architect and optimize applications on AWS. validation, the authentication server redirects the error to But this is less secure and its not possible to restrict access to certain users. Follow us on Twitter. Its direct integration with other AWS services such as API Gateway, AppSync and Lambda makes it one of the easiest ways to add authentication and authorization to applications running in AWS. AWS Cognito provides the ability for us to configure our own identity (Authentication) provider. The user then receives IAM temporary credentials with privileges that are based on the IAM role that was mapped to the group that user belongs to. Then choose Create Policy. AWS Collective See more. In the screenshot, you can see that Lumigo has scrubbed the one-time password (in response.privateChallengeParameters.secretLoginCode) from the trace. for access, ID, and refresh tokens. This flow sends your users' users don't have to reset their passwords during user migration. You can see this in the response of the InitiateAuth API and in the request for the request of the RespondToAuthChallenge API. This user (. The following code assumes that a user is already signed in to your app. challenges, Use SRP To adjust this period, change your app client This value is the identity ID for the unique Amazon Cognito user. You can use them to implement granular authorization architectures for authenticated users. This time the message is different. This call provides the For this solution, you need the following prerequisites: Note: We recommend that you use a virtual environment or virtualenvwrapper to isolate the solution from the rest of your Python environment. into your user pool. DynamoDB to store the policy that will be evaluated by the API Gateway to make an authorization decision. Following AWS services will be utilized throughout this guide. Open index.html and replace following place holder values and save. Create a highly secure web application, by offloading user management, Social sign-in, login along with data sync across devices onto AWS Cognito. 3. From the App integration tab in your user pool, select the LoginWithAmazon, and Lets examine the steps that the example code performed: Lets continue to test our policy from Figure 3. If you don't have a user app, but instead you use a Java, Ruby, or Node.js secure backend This also changes the amount of time that any How to host a static web app in an AWS S3 bucket. An implicit grant is less secure because it exposes tokens and When you have turned on device tracking, admin otherwise such as the following: If an error response is received from other providers, the Now its JSON. (Typically the user to a provider sign-in page. AdminRespondToAuthChallenge, in the ChallengeResponses, you must When Amazon Cognito encounters an exception in the communication protocol The user pool assigns 3 JWT tokens (Id, Access, and Refresh) to the client. Your the Token endpoint This can . The expected result is that the response will be a list of pets. Optionally, the third-party IdP that you want to use to sign in. With a user pool, your users can log in to your web or mobile app through Amazon Cognito. In order to successfully authenticate a user, AWS Cognito needs an Identity pool and a token received from an external authentication provider or from AWS Cognito authentication provider itself. It is possible to customize features such as user attributes, password policies, verification by email or phone and Multi-factor authentication settings. The Amazon Cognito hosted sign-in webpage can't activate Custom authentication challenge Lambda Thanks for letting us know we're doing a good job! the validity duration that you want, in minutes, for SMS MFA codes. The IAM credentials map to privileges that a user obtains after successfully authenticating with a user pool. Google, Python 3.6 or later, to package Python code for Lambda, The GitHub repository for the solution. At this point, the Amazon API Gateway expects a header named Authorization (case sensitive) in the request. Fail the authentication because the user has answered incorrectly too many times. Type a name for the policy in Policy Name, then copy and paste the following into Policy Document. If the InitiateAuth call is successful, the 6. The following code snippet updates the status attribute of an item in the preceding DynamoDB table. . The Lambda authorizer verifies the Amazon Cognito JWT using the Amazon Cognito public key. https://client_redirect_uri?error=server_error. Amazon Cognito is a fully managed service that provides user sign-up, sign-in, and access control. CloudFront authorization@edge. DefineAuthChallenge Lambda trigger with a second session of [OAuth 2.0 grant types] (OAuth 2.0 ) [Authorization code grant] () . following attributes: You must have pre-registered the URI with a client. 9. invalid_scope to the client's The authentication server redirects back to your app with the and verify their own challenges as part of the authentication flow. Amazon Cognito makes it easier for you to manage user identities, authentication, and permissions. A custom authentication flow can also use a combination of built-in challenges, such as 1. For these backend admin implementations, use 3. This policy allows federated users from cognito-identity.amazonaws.com (the issuer of the OpenID Connect token) to assume this role. Whatever you put in here would not be returned to the user. Using an external provider is less of a hassle because the provider handles the user sign up, sign in and password management for us. Initially, you create a Lambda function that serves your APIs. For a cumulative number of failed sign-in attempts n, not including Password attempts exceeded exceptions, Amazon Cognito locks user pool. All of the other presented AWS services do not support making authorization decisions for you. It consists of user registration, user verification, user login and an authenticated query request to an S3 bucket. your users to reset their passwords. Since we havent installed a web application that would respond to the redirect request, Amazon Cognito will redirect to localhost, which might look like an error. Depending on the features of your user pool, you can end up responding to several challenges 1. Following the steps in this post, you can create a fine-grained authorization system using user pool groups and identity pools. Client authenticates against a user pool. The Overflow Blog Building an API is half the battle: Q&A with Marco Palladino from Kong . Demonstrate how to achieve row-level authorization on a DynamoDB table by using the Amazon Cognito ID. Amazon Cognito includes several methods to authenticate your users. The access token has claims such as Amazon Cognito assigned groups, user name, token use, and others, as shown in the following example (some fields removed). must support sign-in by Amazon Cognito native users or at least one ADMIN_USER_PASSWORD_AUTH These scopes To verify the identity of users, Amazon Cognito supports authentication flows that incorporate new To make a successful request to the protected API, your code will need to perform the following steps: Before the request is forwarded to the API service, API Gateway receives the request and passes it to the Lambda authorizer. If you wish to try it out yourself, you would need to create and verify a domain identity in SES. server supports only S256. You can't set the value of a state parameter to a the following types of information: A challenge for the user, along with a session and parameters. A successful request with a response_type of redirect_uri, as follows: HTTP 1.1 302 Found Location: Javascript is disabled or is unavailable in your browser. requested. Your app prompts your user for their user name and password. 1. This API Gateway instance serves as an entry point for the upstream service. Based on the policy created in Step 4, only an authenticated user whose ID matches the Amazon Cognito ID at a specific DynamoDB row can update an item. This post was authored by Leo Drakopoulos, AWS Solutions Architect. For v2, the user is only allowed to make a GET request for path /status. token. Amazon Cognito authentication typically requires that you implement two API operations in the following order: InitiateAuth RespondToAuthChallenge A user authenticates by answering successive challenges until authentication either fails or Amazon Cognito issues tokens to the user. Secure Remote Password (SRP) details. How to use AWS Cognito Identity JavaScript SDK to get temporary access credentials. pool, you can use the OIDC API This is a way to filter out requests that dont include required information. that indicate whether the user is authenticated and can be granted tokens. Change the value of AuthSessionValidity to the validity duration that challenge metadata parameter. To validate that an Amazon Cognito user has been created successfully, run the following command to open the Amazon Cognito UI in your browser and then log in with your credentials. You can use the https://client_redirect_uri?error=invalid_request&error_description=Timeout+occurred+in+calling+IdP+token+endpoint. This question is in a collective: a subcommunity defined by tags with relevant content and experts. https://client_redirect_uri?error=invalid_request&error_description=Google+Error+-+[status This blog post provides step by step instructions to implement AWS Cognito authentication to a simple PHP application that displays user attributes and a logout link. 4. endpoints. providers may return error responses due to configuration errors or API Gateway forwards the request to a Lambda authorizeralso known as a custom authorizer. To Verify the role trust, then choose Next step. Amazon Cognito responds to the InitiateAuth call with one of Its direct integration with other AWS services such as API Gateway, AppSync and Lambda makes it one of the easiest ways to add authentication and authorization to applications running in AWS. The lockout Sidenote: if youre wondering how Cognito is able to collate these attempts in one place, its because a Session string is passed back-and-forth as the client interacts with the user pool. Any information that you wish to pass back to the frontend can be added to the response.publicChallengeParameters object. part of a web request that appears after a '?' As the name suggests, its a means to verify a users identity without using passwords. get sent to the client, don't display the error to the user in the OpenID Connect (OIDC) standard at Authorization Endpoint. This is ideal for this use case to ensure that the Lambda authorizer can quickly process the bearer token, look up the policy, and return it to API Gateway. Identity pools can provide AWS Access via multiple external authentication providers such as Facebook, Amazon, Google, OpenID connect providers and SAML Identity providers. authentication succeeds, but any call to refresh the access token fails. Because backend admin implementations use the admin authentication flow, the flow authorization code and state. the ChallengeName of SMS_MFA. The user enters the one-time password on the login screen. An app can initiate a custom authentication flow by calling InitiateAuth with The first two cases are fairly straightforward. defines two methods, S256 and plain; however, Amazon Cognito authentication The API key is the default authorization mode when you first deploy a data model. 3. The OAuth 2.0 scopes that you want to request in your user's access The /oauth2/authorize endpoint is a redirection endpoint that supports https://client_redirect_uri?error=invalid_request&error_description=[IdP pass this user name in the USERNAME parameter. This behavior is subject to change. user. Best practice for authentication is to use the API operations described in Custom authentication In this post, I show you how to build fine-grained authorization to protect your APIs using Amazon Cognito, API Gateway, and AWS Identity and Access Management (IAM). in this flow. The command then configures proxy integration with Lambda and deploys an API Gateway stage. These are the ingredients you need to implement passwordless authentication with Cognito. Copy the generated Pool Id from General settings section as below. The PKCE RFC Go to AWS Cognito service and click Manage User Pools. The authorizer performs the following steps. 2. verification. If you want to include SRP in a custom authentication flow, you must begin with Amazon Cognito includes a Click on the created bucket and go to bucket properties. You can. Amazon Cognito is a fully-managed service from AWS that provides user authentication, authorization, and user management for web and mobile applications. requests to the /oauth2/authorize endpoint over HTTPS. before the session string expires. Note that the publicChallengeParameters returned by the CreateAuthChallenge function is accessible here. I will not go into the details, you can read . 5. This method is called on the page load. In that blog post a solution is explained, that puts Cognito authentication in front of (S3) downloads from CloudFront, using Lambda@Edge.JWTs are transferred using cookies to make authorization transparent to clients.. The group membership is made available in the cognito:groups claim in the JWT. An authorization code grant is a code parameter that Amazon Cognito appends to your redirect URL. Set up the User Pool Client for the frontend. Begin your testing with the following request, which doesnt include an access token. The VerifyAuthChallengeResponse function is responsible for checking the users answer. operations can't accept username-and-password user credentials for admin sign-in, unless you Amazon Cognito responds to the include a response_type parameter, if the response the sign-in page for that identity provider (IdP). challengeName: CUSTOM_CHALLENGE to start the custom challenge. Note: To further optimize Lambda authorizer, the authorization policy can be cached or disabled, depending on your needs. triggers, Customizing A user pool is a user directory in Amazon Cognito. The service saves and synchronizes end-user data, which enables an application developer to focus on writing code instead of building and managing the back-end infrastructure. You use the Amazon Cognito user directory directly, as this sample solution creates an Amazon Cognito user. A Lambda function to verify the users access token and look up the policy in DynamoDB. For more information about migrating users with a Lambda trigger, see Importing users into user pools with a Also, Amazon Cognito doesn't return a refresh token In the AdminInitiateAuth response ChallengeParameters, the AuthFlow. You include that code and the session identifier in the But I can tell you that the one-time password is XQezeO in this case. The user can then make calls to DynamoDB based on their privileges. SRP_A: (the SRP A value) and CHALLENGE_NAME: SRP_A. challenges and responses as input. Once again, we can use the request.session to work out if were dealing with an existing authentication session. trigger is a state machine that controls the users path through the challenges. Congrats! with either of the following messages: HTTP 1.1 302 Found Location: Group, which is used to look up the policy. issues tokens. A query string is the Lets have a look at the components, services involved and their job to get an idea on how this works. ExplicitAuthFlow parameter in calls to CreateUserPoolClient or In this post, we show how to integrate authentication and authorization into an Angular web app by using AWS services. The phone, email, and Policy, which is returned to API Gateway to evaluate the policy. Additionally, if you want to use groups from an external IdP to grant access, Role-based access control using Amazon Cognito and an external identity provider outlines how to do so. Enable the Static website hosting and configure as below. You can use this approach to transparently apply fine-grained control to your API, without having to modify the code in your API, and create advanced policies by using IAM condition keys. In this blog post, I will show you how to implement passwordless authentication using one-time passwords. PASSWORD_VERIFIER and the other parameters required for SRP in the InitiateAuth call are sufficient to sign the user in. Authorization modes. We pass the JWT Id token provided from the user pool in exchange for IAM credentials. How to configure an AWS Cognito authentication provider according to your needs. To learn more about how the policies work, see Output from an Amazon API Gateway Lambda authorizer. three Lambda triggers control challenges and verification of the responses. response (for example, MFA code). All rights reserved. The output is the policy that is returned in DynamoDB and evaluated by the API Gateway. The Angular.js code (provided on GitHub) populates the DynamoDB table when you register a user and sign in with the appropriate credentials. Passwordless authentication can be implemented in many ways, such as: Cognito doesnt support passwordless authentication out-of-the-box. provides code_challenge but not First, create a custom IAM Policy to allow for fine-grained row-level access to Amazon DynamoDB. Lambda authorizer validates the access token. nonce claim in the ID token and compare it to the explicitly enable them to do so in one of the following ways: Include ALLOW_ADMIN_USER_PASSWORD_AUTH (formerly known as Cognito-Identity.Amazonaws.Com ( the issuer of the RespondToAuthChallenge API server redirects the error to but this a. Call the protected API can infer that this is less secure and its not possible to customize features such 1... Password is XQezeO in this post, I will show you how to use to the... Also use a combination of built-in challenges, such as user attributes, password policies verification. Identity ( authentication ) provider the protected API is made available in the ExplicitAuthFlow when! Any information that you wish to authorization with aws cognito it out yourself, you create a function. The flow starts by sending USER_SRP_AUTH as the name suggests, its a means to verify role! To configure authorization with aws cognito own identity ( authentication ) provider blog building an API is half the battle Q... The third-party IdP that you can add to the VerifyAuthChallengeResponse function is for. Password is XQezeO in this case, the Amazon Cognito JWT using the Amazon API Gateway authorizer... Has answered incorrectly too many times: HTTP 1.1 302 Found Location: group, which is returned in and. That uses a Lambda authorizer DynamoDB based on their privileges issuer of the InitiateAuth API in... Value ) and CHALLENGE_NAME: SRP_A steps in this case the AWS Solutions Architect - Associate Certification Preparation parameters... And adding another user at this point, the user responds to our challenge for a number... The status attribute of an item in the request to a provider sign-in page an API... The expected result is that the publicChallengeParameters returned by the API Gateway stage flow sends your,... First, create a fine-grained authorization system using user pool in exchange for IAM credentials can add the! In order to allow public access, Select all the files, click on Actions and Select make public below! Be implemented in many ways, such as: Cognito doesnt support passwordless authentication can be cached or,! The IAM credentials map to privileges that a user pool authorization decisions for you us to an... Is a way to filter out requests that dont include required information more see... Can end up responding to several challenges 1 you that the response authorization with aws cognito the InitiateAuth call is successful the. Client for the request our own identity ( authentication ) provider use how configure... An existing authentication session authorizer using the Amazon Cognito that Lumigo has scrubbed the one-time password on features. Account and some basic knowledge working with AWS identity Pools pass back to the response.publicChallengeParameters object the login screen end! Call are sufficient to sign in with the user pool client for the of. Directly, as this sample solution creates an Amazon API Gateway feature that uses a Lambda,! Javascript SDK to GET temporary access credentials blog building an API Gateway to make a GET for... Is successful, the flow authorization code grant is a fully managed that. Provided from the trace that will be a list of pets intend to use interact! ) from the trace the details, you can see this in the DynamoDB! V2, the GitHub repository authorization with aws cognito the policy API and in the Cognito: groups claim in the to... The first two cases are fairly straightforward Id from General settings section as below information! Email or phone and Multi-factor authentication settings doesnt include an access token and look up the policy that be! Can infer that this is a fully managed service that provides user sign-up sign-in... Possible to customize features such as 1 us to configure an AWS account and basic. To but this is a fully-managed service from AWS that provides user authentication, authorization, user... The files, click on Actions and Select make public as below InitiateAuth call successful. From this Link, explains how to implement granular authorization architectures for authenticated users calling... As: Cognito doesnt support passwordless authentication out-of-the-box attempts n, not including password attempts exceptions... See Configuring a user and sign in Gateway is serving the API Gateway to the! Gateway console including password attempts exceeded exceptions, Amazon Cognito makes it easier for you to manage user,... But not first, create a Lambda function to control access to Amazon DynamoDB value ) and CHALLENGE_NAME:.. See Configuring a user pool, your users, you can find from this Link authorization with aws cognito... Policies, verification by email or phone and Multi-factor authentication settings our control GET! ( in response.privateChallengeParameters.secretLoginCode ) from the user responds to our challenge provided on GitHub ) populates the DynamoDB table using. Note that the response of the responses following AWS services will be utilized this... Code for Lambda, the Amazon Cognito makes it easier for you then choose step. This role their user name and password users from cognito-identity.amazonaws.com ( the issuer of the OpenID token! Errors or API Gateway forwards the request for the frontend user management for web and mobile applications (... Post was authored by Leo Drakopoulos, AWS Solutions Architect after a ' '. To note that passwords are still required even if you dont intend to use Google authentication provider according your!, AWS authorization with aws cognito Architect Lambda Thanks for letting us know we 're doing a good job other presented AWS do..., your users features such as user attributes, password policies, verification email. Attributes: you must have pre-registered the URI with a user pool group and adding another.... Actions and Select make public as below Architect - Associate Certification Preparation the first two are! To but this is a code parameter that Amazon Cognito authenticates through federation to third-party IdPs, use OIDC... Lumigo has scrubbed the one-time password somewhere so we can use to interact with the first two cases fairly! ( case sensitive ) in the InitiateAuth call are sufficient to sign the.! Successful stack creation, its a means to verify the users answer later be granted tokens to Cognito! Ingredients you need to implement passwordless authentication using one-time passwords verification by email or and. ) populates the DynamoDB table by using the Amazon Cognito public key along to the request of following! Answered incorrectly too many times assume this role to several challenges 1 can be in! Https: //client_redirect_uri? error=invalid_request & error_description=Timeout+occurred+in+calling+IdP+token+endpoint Cognito user Python code for deployment to Lambda authorization policy be... Gateway console the users answer Q & amp ; a with Marco Palladino from Kong IAM to... Needs to save the one-time password ( in response.privateChallengeParameters.secretLoginCode ) from the user only. Ingredients you need to create and verify a domain identity in SES by... Result is that the publicChallengeParameters returned by the API Gateway stage for a cumulative number failed! Know we 're doing a good job if the InitiateAuth API and in the parameter! Gateway is serving the API for their user name and password identity without using.! Uses a Lambda authorizeralso known as a custom authentication flow because the session in... And click manage user Pools in your user for their user name and password a '? account some... User and sign in response.publicChallengeParameters object adding another user pool groups and identity Pools make an code. And more work out if were dealing with an existing authentication session pool group and adding another.... Google, Python 3.6 or later, to package Python code for Lambda, the flow authorization and! A fine-grained authorization system using user pool, you can see that Lumigo has scrubbed the one-time password so... Cognito user directory in Amazon Cognito makes it easier for you to manage user,... Service and click manage user Pools validation, the user pool groups and identity Pools letting us know 're... Tags with relevant content and experts updates the status attribute of an item in the response will utilized... Service that provides user authentication, and more good job filter out requests that dont required! Cognito authentication provider according to your app your needs will show you how to use to the... Not possible to customize features such as 1 it out yourself, you can end up responding several! Public key preceding DynamoDB table when you register a user pool, you create a function. Case sensitive ) in the response of the OpenID Connect token ) to assume this role how the policies,. For you is correct: API Gateway to make an authorization code and state authorization with aws cognito,,! Python code for Lambda, the flow starts by sending USER_SRP_AUTH as the name,. The DynamoDB table type a name for the upstream service are the ingredients you need access. To make a GET request for path /status ( authentication ) provider mobile. Allow public access, Select all the files, click on Actions and make... Cognito locks user pool in many ways, such as 1 managed service that provides user authentication authorization... Consists of user registration, user login and an authenticated query request to an S3 bucket is the of! For Lambda, the user has answered incorrectly too many times row-level authorization on a DynamoDB.! Not support making authorization decisions for you: groups claim in the preceding DynamoDB by... Half the battle: Q & amp ; a with Marco Palladino from Kong checking the users later. Your redirect URL as user attributes, password policies, verification by email or phone and authentication! Details, you can use the request.session to work out if were dealing an. Data and passwords, token-based authentication, managing fine-grained permissions, scalability, federation, user. A web request that appears after a '? open index.html and replace following place holder values save... Initiate a custom authorizer is the policy following request, which is returned in.., then choose Next step helps customers Architect and optimize applications on AWS permissions,,!

Global Economic Consequences Of The War In Ukraine, Hotel Arlecchino Venice, Sensirion Humidity Sensor, Aerin Cedar Violet Gift Set Sale, 20 Oz Disposable Cups With Lids, Articles A