Question

我正在尝试使用Cognito对Java应用进行身份验证。我已经为python使用了效果很好的凭单库。但是我现在想在Java中做同样的事情。

我用于warrant库认证的Python函数

def SRPauthentication(organizationAdmin,
                     password,
                     pool_id,
                     client_id,
                     client):
    aws = AWSSRP(username=organizationAdmin,
                 password=password,
                 pool_id=pool_id,
                 client_id=client_id,
                 client=client)
    tokens = aws.authenticate_user()
    authorization_token= tokens['AuthenticationResult']['IdToken']
    return authorization_token

我可以很容易地加入一些安全的API。现在我想对Java进行同样的操作，但是我遇到了问题。

这是我迄今为止的解决方法：

  public static void GetCreds()
      {

          AWSCognitoIdentityProvider identityProvider = AWSCognitoIdentityProviderClientBuilder.defaultClient();
          AdminInitiateAuthRequest adminInitiateAuthRequest = new AdminInitiateAuthRequest().
                  withAuthFlow(AuthFlowType.USER_SRP_AUTH).
                  withClientId("234234234234").withUserPoolId("eu-central-1_sdfsdfdsf")
                  .addAuthParametersEntry("USERNAME", "UserK").
                   addAuthParametersEntry("PASSWORD","#######);

          adminInitiateAuthRequest.getAuthFlow();
          AdminInitiateAuthResult adminInitiateAuth = identityProvider.adminInitiateAuth(adminInitiateAuthRequest);
            System.out.println(adminInitiateAuth.getAuthenticationResult().getIdToken());
      }

运行此命令时出现异常：线程“主”中的异常com.amazonaws.services.cognitoidp.model.AWSCognitoIdentityProviderException：用户：arn：aws：iam :: XXXXXXXXXXXXXXXXX：用户/ khan无权执行：对资源的ognito-idp：AdminInitiateAuth：arn：aws： cognito-idp：eu-central-1：XXXXXXXX：userpool / eu-central-1_XXXXXXX（明确拒绝）（服务：AWSCognitoIdentityProvider；状态代码：400；错误代码：AccessDeniedException；请求ID：21be0b8e-adec-11e8-ad45-234234234 ）

它说iam无权执行这种指示。所以我想我做的事情通常是错误的。因为它可以在我的python代码和Java中工作，所以可以从凭据中识别出我的用户名。 Cognito呼叫实际上应该独立于我的AWS凭证/用户帐户吗？

如何使用Java使用Cognito进行身份验证以获得访问安全的AWS服务的令牌？

编辑：

  AWSCognitoIdentityProvider identityProvider = AWSCognitoIdentityProviderClientBuilder.standard()
              .build();
      InitiateAuthRequest adminInitiateAuthRequest = new InitiateAuthRequest()
              .withAuthFlow(AuthFlowType.USER_SRP_AUTH)
              .withClientId("XXXXXXXXXXXXXXXXX")
              .addAuthParametersEntry("USERNAME", "user").
               addAuthParametersEntry("PASSWORD","za$Lwn")
              .addAuthParametersEntry("SRP_A",new AuthenticationHelper("eu-central-1XXXXXXXXX").getA().toString(16));

      adminInitiateAuthRequest.getAuthFlow();
      InitiateAuthResult adminInitiateAuth = identityProvider.initiateAuth(adminInitiateAuthRequest);
      System.out.println(adminInitiateAuth);

我将AdminInitateAuthRequest更改为InitateAuthRequest。之后，我遇到了Error SRP_A参数丢失的问题，我用类似的问题here 现在，我讲到这一点：

{ChallengeName: PASSWORD_VERIFIER,ChallengeParameters: {SALT=877734234324234ed68300f39bc5b, SECRET_BLOCK=lrkwejrlewrjlewkjrewlrkjwerlewkjrewlrkjewrlkewjrlewkrjZ+Q==, USER_ID_FOR_SRP=user, USERNAME=user, SRP_B=43ecc1lwkerjwelrkjewlrjewrlkewjrpoipweoriwe9r873jr34h9r834hr3455f7d079d71e5012f1623ed54dd10b832792dafa3438cca3f59c0f462cbaee255d5b7c2werwerwerkjweorkjwerwerewrf5020e4f8b5452f3b89caef4a797456743602b80b5259261f90e52374adc06b456521a9026cce9c1cbe8b9ffd6040e8c1589d35546861422110ac7e38c1c93389b802a03e3e2e4a50e75d088275195f836f66e25f1a431dd56bb2},}

我已经用所有键缩短了结果，但是下一步该怎么做？

Answer 1

最后，我可以使用this代码类来解决它。 SRP身份验证涉及多个挑战。 InitiateAuthRequest是一个必要的第一个请求。

这个类似的问题帮助我： stackoverflow stackoverfow

String PerformSRPAuthentication(String username, String password) {
    String authresult = null;

    InitiateAuthRequest initiateAuthRequest = initiateUserSrpAuthRequest(username);
    try {
        AnonymousAWSCredentials awsCreds = new AnonymousAWSCredentials();
        AWSCognitoIdentityProvider cognitoIdentityProvider = AWSCognitoIdentityProviderClientBuilder
                .standard()
                .withCredentials(new AWSStaticCredentialsProvider(awsCreds))
                .withRegion(Regions.fromName(this.region))
                .build();
        InitiateAuthResult initiateAuthResult = cognitoIdentityProvider.initiateAuth(initiateAuthRequest);
        if (ChallengeNameType.PASSWORD_VERIFIER.toString().equals(initiateAuthResult.getChallengeName())) {
            RespondToAuthChallengeRequest challengeRequest = userSrpAuthRequest(initiateAuthResult, password);
            RespondToAuthChallengeResult result = cognitoIdentityProvider.respondToAuthChallenge(challengeRequest);
            //System.out.println(result);
            System.out.println(CognitoJWTParser.getPayload(result.getAuthenticationResult().getIdToken()));
            authresult = result.getAuthenticationResult().getIdToken();
        }
    } catch (final Exception ex) {
        System.out.println("Exception" + ex);

    }
    return authresult;
}


 private InitiateAuthRequest initiateUserSrpAuthRequest(String username) {

    InitiateAuthRequest initiateAuthRequest = new InitiateAuthRequest();
    initiateAuthRequest.setAuthFlow(AuthFlowType.USER_SRP_AUTH);
    initiateAuthRequest.setClientId(this.clientId);
    //Only to be used if the pool contains the secret key.
    //initiateAuthRequest.addAuthParametersEntry("SECRET_HASH", this.calculateSecretHash(this.clientId,this.secretKey,username));
    initiateAuthRequest.addAuthParametersEntry("USERNAME", username);
    initiateAuthRequest.addAuthParametersEntry("SRP_A", this.getA().toString(16));
    return initiateAuthRequest;
}

Cognito SRP身份验证JAVA SDK

1 个答案: