问题

1. 我正在使用 AWS Cognito 认证进行签名机制。为了获取凭证（访问凭证、秘密凭证和会话令牌），我们需要获取身份令牌。
2. 我拥有用户名、密码、客户端 ID、用户池 ID、身份池 ID 信息。然而，当我尝试使用 USER_PASSWORD_AUTH 作为认证流程类型生成 ID 令牌时，我得到了以下错误：

由于：com.amazonaws.services.cognitoidp.model.AWSCognitoIdentityProviderException: 缺少身份验证令牌（服务：AWSCognitoIdentityProvider；状态码：400；错误代码：MissingAuthenticationTokenException；请求 ID：；代理：null）

以下是代码：

AnonymousAWSCredentials awsCreds = new AnonymousAWSCredentials();

AWSCognitoIdentityProvider provider = AWSCognitoIdentityProviderClientBuilder.standard()
    .withCredentials(new AWSStaticCredentialsProvider(awsCreds))
    .withRegion(//region)
    .build();

AdminInitiateAuthRequest authRequest = new AdminInitiateAuthRequest()
    .withAuthFlow(AuthFlowType.USER_PASSWORD_AUTH)
    .withClientId("")
    .withUserPoolId("")
    .withAuthParameters(map);
Map<String, String> map = new HashMap<>();
map.put("USERNAME", "");
map.put("PASSWORD", "");

在这里，map 将包含用户名和密码。

有人可以帮助我如何在 Java 中配置身份验证以生成 ID 令牌和访问令牌吗？提前谢谢！

AnonymousAWSCredentials awsCreds = new AnonymousAWSCredentials();

    AWSCognitoIdentityProvider provider = AWSCognitoIdentityProviderClientBuilder.standard()
            .withCredentials(new AWSStaticCredentialsProvider(awsCreds))
            .withRegion(//region)
            .build();
           

    AdminInitiateAuthRequest authRequest = new AdminInitiateAuthRequest()
            .withAuthFlow(AuthFlowType.USER_PASSWORD_AUTH)
            .withClientId("")
            .withUserPoolId("")
            .withAuthParameters(map);
    Map<String,String> map = new HashMap<>();
    map.put("USERNAME","");
    map.put("PASSWORD","");

答案1

得分: 4

你的代码可能如下所示。请注意：

1. 用于身份验证的是ADMIN_USER_PASSWORD_AUTH流程。请参阅AdminInitiateAuth。

2. 在Cognito中，在客户端设置中，在“Auth Flows Configuration”部分下，下一个选项应启用“为管理员API启用用户名密码身份验证（ALLOW_ADMIN_USER_PASSWORD_AUTH）”。

public static void auth(String username, String password) {

    AwsBasicCredentials awsCreds = AwsBasicCredentials.create(AWS_KEY,
            AWS_SECRET);

    CognitoIdentityProviderClient identityProviderClient =
            CognitoIdentityProviderClient.builder()
                    .credentialsProvider(StaticCredentialsProvider.create(awsCreds))
                    .region(Region.of(REGION))
                    .build();

    final Map<String, String> authParams = new HashMap<>();
    authParams.put("USERNAME", username);
    authParams.put("PASSWORD", password);
    authParams.put("SECRET_HASH", calculateSecretHash(CLIENT_ID,
            CLIENT_SECRET, username));

    final AdminInitiateAuthRequest authRequest = AdminInitiateAuthRequest.builder()
            .authFlow(AuthFlowType.ADMIN_USER_PASSWORD_AUTH)
            .clientId(CLIENT_ID)
            .userPoolId(POOL_ID)
            .authParameters(authParams)
            .build();

    AdminInitiateAuthResponse result = identityProviderClient.adminInitiateAuth(authRequest);

    System.out.println(result.authenticationResult().accessToken());
    System.out.println(result.authenticationResult().idToken());
}

private static String calculateSecretHash(String userPoolClientId, String userPoolClientSecret, String userName) {
    final String HMAC_SHA256_ALGORITHM = "HmacSHA256";

    SecretKeySpec signingKey = new SecretKeySpec(
            userPoolClientSecret.getBytes(StandardCharsets.UTF_8),
            HMAC_SHA256_ALGORITHM);
    try {
        Mac mac = Mac.getInstance(HMAC_SHA256_ALGORITHM);
        mac.init(signingKey);
        mac.update(userName.getBytes(StandardCharsets.UTF_8));
        byte[] rawHmac = mac.doFinal(userPoolClientId.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(rawHmac);
    } catch (Exception e) {
        throw new RuntimeException("Error while calculating ");
    }
}

3. 方法calculateSecretHash取自AWS文档Signing Up and Confirming User Accounts：

private static String calculateSecretHash(String userPoolClientId, String userPoolClientSecret, String userName) {
    final String HMAC_SHA256_ALGORITHM = "HmacSHA256";

    SecretKeySpec signingKey = new SecretKeySpec(
            userPoolClientSecret.getBytes(StandardCharsets.UTF_8),
            HMAC_SHA256_ALGORITHM);
    try {
        Mac mac = Mac.getInstance(HMAC_SHA256_ALGORITHM);
        mac.init(signingKey);
        mac.update(userName.getBytes(StandardCharsets.UTF_8));
        byte[] rawHmac = mac.doFinal(userPoolClientId.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(rawHmac);
    } catch (Exception e) {
        throw new RuntimeException("Error while calculating ");
    }
}