[英]Manual Authentication with Amazon Cognito
我知道作为用户身份验证和获取access token
的两种方法,一种是通过托管 UI ,另一种是使用各种提供的 SDK 。
我正在寻找的是一个端点直接使用用户凭据获取access token
。
POST https://that-special-endpoint.com/login
{
username: "example@email.com",
password: "Abc123456",
...client ID, etc.
}
我已经搜索了一段时间,但找不到如何做到这一点。 由于一些我不知道的安全问题,这不可能吗?
我确实考虑过创建一个 Lambda API 并使用 Cognito SDK 来满足我的用例,但我不确定它是否可取...
类似的问题在这里得到了回答。 您可以访问https://cognito-idp.[region].amazonaws.com/
以调用InitiateAuth
和RespondToAuthChallenge
API。
发起验证
aws-auth-data.json
{
"AuthParameters": {
"USERNAME": "your-email@example.com",
"PASSWORD": "your-first-password",
"SECRET_HASH": "......(required if the app client is configured with a client secret)"
},
"AuthFlow": "USER_PASSWORD_AUTH",
"ClientId": "5m........................"
}
https://cognito-idp.us-east-2.amazonaws.com/
上发送请求(如果用户池位于us-east-2
区域)以调用InitiateAuth
API 并启动身份验证流程。curl -X POST --data @aws-auth-data.json \
-H 'X-Amz-Target: AWSCognitoIdentityProviderService.InitiateAuth' \
-H 'Content-Type: application/x-amz-json-1.1' \
https://cognito-idp.us-east-2.amazonaws.com/
{
"AuthenticationResult": {
"AccessToken": "eyJra........",
"ExpiresIn": 3600,
"IdToken": "eyJra........",
"RefreshToken": "eyJjd........",
"TokenType": "Bearer"
},
"ChallengeParameters": {}
}
响应身份验证挑战
您可能会收到一个挑战作为InitiateAuth
响应。 例如,当您第一次尝试“InitiateAuth”时,系统会要求您更改密码:
{
"ChallengeName": "NEW_PASSWORD_REQUIRED",
"ChallengeParameters": {
"USER_ID_FOR_SRP": "abababab-......",
"requiredAttributes": "[]",
"userAttributes": "{\"email_verified\":\"true\",\"email\":\"your-email@example.com\"}"
},
"Session": "DNdY......"
}
在这种情况下,使用RespondToAuthChallenge
更改密码,您将获得令牌。
{
"ChallengeName": "NEW_PASSWORD_REQUIRED",
"ChallengeResponses": {
"USERNAME": "your-email@example.com",
"NEW_PASSWORD": "your-second-password"
},
"ClientId": "5m........................",
"Session": "DNdYN...(what you got in the preceding response)"
}
curl -X POST --data @aws-change-password.json \
-H 'X-Amz-Target: AWSCognitoIdentityProviderService.RespondToAuthChallenge' \
-H 'Content-Type: application/x-amz-json-1.1' \
https://cognito-idp.us-east-2.amazonaws.com/
也可以看看:
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.