Firebase作为Cognito/AWS的身份提供商

Question

我很难将Firebase用作Open ID Connect提供程序。你能进一步描述一下你在完成这项工作之前和之后所经历的步骤吗？

作为参考，以下是我迄今为止所做的工作：在AWS控制台中：

1-创建IAM身份提供程序(OpenID Connect)并使用securetoken.google.com/<FIREBASE_PROJECT_ID>作为URL，<FIREBASE_PROJECT_ID>用于受众

2-手动检查指纹(与AWS生成的指纹匹配)

3-创建了一个具有访问所需服务权限的角色

4-在Cognito中创建了一个身份池，并在"身份验证角色"下拉中选择了我新创建的角色

5-在Authentication Providers>OpenID类别下选择了我的Identity Provider(因此格式为)：securetoken.google.com/<FIREBASE_PROJECT_ID>

在我的代码中(我使用的是Vue.js)，以下是我所经历的逻辑步骤：

• 导入/设置AWS SDK

• 调用Firebase身份验证服务

• 创建新的CognitoIdentity
• 使用getOpenIdTokenForDeveloperIdentity并推送从Firebase接收的tokenID

问题是我不断收到"配置中缺少凭据"的错误。

代码：

import axios from 'axios';
const AWS = require('aws-sdk');
AWS.config.region = 'eu-west-1';
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'MY_COGNITO_POOL_ID',
});
export default {
name: 'My Vue.js component name',
data() {
return {
email: '',
password: '',
msg: '',
};
},
methods: {
submit() {
axios
.post(
'https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyPassword?key=MY_KEY',
{
email: this.email,
password: password,
returnSecureToken: true,
},
)
.then((res) => {
// stores tokens locally
localStorage.setItem('jwt', JSON.stringify(res.data));
const cognitoidentity = new AWS.CognitoIdentity();
const params = {
IdentityPoolId: 'MY_COGNITO_POOL_ID',
Logins: {
'securetoken.google.com/<PROJECT_ID>': res.data.idToken,
},
IdentityId: null,
TokenDuration: 3600,
};
cognitoidentity.getOpenIdTokenForDeveloperIdentity(params, (err, data) => {
if (err) console.log(err, err.stack); // an error occurred
else console.log(data);           // successful response
});
});
},
},
};

以下是我迄今为止在尝试实现这一目标时使用的资源：

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html

使用Firebase OpenID Connect提供程序作为AWS IAM身份提供程序

https://github.com/aws/amazon-cognito-identity-js/blob/master/examples/babel-webpack/src/main.jsx

http://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html

https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-authentication/

https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-authentication-part-2-developer-authenticated-identities/

https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-authentication-part-3-roles-and-policies/

https://aws.amazon.com/blogs/mobile/understanding-amazon-cognito-authentication-part-4-enhanced-flow/

Answer 1

如果这对任何人都有帮助，那么最后的代码是：

import axios from 'axios';

const AWS = require('aws-sdk');
const aws4 = require('aws4');

export default {
name: 'VUE_CPNT_NAME',
data() {
return {
email: '',
password: '',
msg: '',
idToken: '',
};
},
methods: {
submit() {
// Firebase SignIn API
// Doc: https://firebase.google.com/docs/reference/rest/auth/
axios
.post(
'https://www.googleapis.com/identitytoolkit/v3/relyingparty/verifyPassword?key=[MY_KEY]',
{
email: this.email,
password: this.password,
returnSecureToken: true,
},
)
.then((res) => {
this.idToken = res.data.idToken;
localStorage.setItem('jwt', JSON.stringify(res.data));
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'IDENTITY_POOL_ID',
Logins: {
'securetoken.google.com/<FIREBASE_PROJECT_ID>': res.data.idToken,
},
}, {
region: 'eu-west-1',
});
// AWS.config.crendentials.get() methods works as well
// or a call to cognitoidentity.getId() followed by a call to getCredentialsForIdentity() 
// will achieve the same thing. Cool. But why!?
AWS.config.getCredentials((err) => {
if (err) {
console.log(err);
}
const request = {
host: 'API_GATEWAY_ENDPOINT.eu-west-1.amazonaws.com',
method: 'GET',
url: 'https://API_GATEWAY_ENDPOINT.eu-west-1.amazonaws.com/PATH',
path: '/API_ENDPOINT_PATH',
};
// Signing the requests to API Gateway when the Authorization is set AWS_IAM.
// Not required when Cognito User Pools are used
const signedRequest = aws4.sign(request,
{
secretAccessKey: AWS.config.credentials.secretAccessKey,
accessKeyId: AWS.config.credentials.accessKeyId,
sessionToken: AWS.config.credentials.sessionToken,
});
// removing the Host header to avoid errors in Chrome
delete signedRequest.headers.Host;
axios(signedRequest);
});
});
},
},
};

Answer 2

• 尝试设置登录映射，即CognitoIdentityCredentials对象中的firebase令牌。请参阅此文档。

  AWS.config.credentials=新的AWS.CognitoIdentityCredentials({IdentityPoolId:"MY_COGNITO_POOL_ID"，登录：{'securetoken.google.com/'：}})

• 在初始化Cognito客户端之前，请尝试对凭据对象调用get方法。您也可以使用getCredentials

• 如果以上步骤不起作用&他们应该在初始化Cognito客户端时将凭据作为选项传递。有关使用CognitoIdentity构造函数时可用的选项，请参阅本文档。

  const-cognitoentity=new AWS.cognitoidentity(｛credentials:AWS.config.credentials｝)

• 如果仍然收到错误，请在调用get()方法后尝试在控制台中记录凭据对象。理想情况下，它应该具有临时凭据(accessKey、secretKey和sessionToken)