[英]cognito - Access to Identity is forbidden
我試圖通過Facebook登錄后了解亞馬遜認知和嘗試S3文件夾的列表內容。 臉書登錄工作正常。 當我點擊測試按鈕(cmdTestS3Tapped)時,它會拋出以下錯誤。
我從Amazon amazon提供的項目中將AmazonClientManager.h,AmazonClientManager.m和Constants.h包含在項目中。 常數以belllow的形式給出。 任何人都可以幫我解決這個問題。
#define AWSAccountID @"MyAccountID"
#define CognitoPoolID @"us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"
#define CognitoRoleAuth @"arn:aws:iam::MyAccountID:role/Cognito_iOSTestPoolAuth_DefaultRole"
#define CognitoRoleUnauth @"arn:aws:iam::MyAccountID:role/Cognito_iOSTestPoolAuth_DefaultRole"
這是角色--Cognito_iOSTestPoolAuth_DefaultRole
{
"Version": "2012-10-17",
"Statement": [{
"Action": [
"mobileanalytics:PutEvents",
"cognito-sync:*"
],
"Effect": "Allow",
"Resource": [
"*"
],
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
}]
}
這是信任關系
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Federated": "cognito-identity.amazonaws.com"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:aud": "us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "unauthenticated"
}
}
}
]
}
這是我正在使用的代碼
- (IBAction)cmdLoginWithFB:(id)sender {
[[UIApplication sharedApplication] setNetworkActivityIndicatorVisible:YES];
[self disableUI];
[[AmazonClientManager sharedInstance] loginFromView:self.view withCompletionHandler:^(NSError *error) {
dispatch_async(dispatch_get_main_queue(), ^{
[self refreshUI];
});
}];
}
-(void)refreshUI {
[[UIApplication sharedApplication] setNetworkActivityIndicatorVisible:NO];
//self.browseDataButton.enabled = YES;
self.cmdLoginWithFB.enabled = YES;
if ([[AmazonClientManager sharedInstance] isLoggedIn]) {
self.cmdLoginWithFB.titleLabel.text = @"Link";
NSLog(@"-----------LOGED IN -------------->");
}
else {
self.cmdLoginWithFB.titleLabel.text = @"Login";
NSLog(@"-----------NOT LOGED IN -------------->");
}
self.cmdLogoutWipe.enabled = [[AmazonClientManager sharedInstance] isLoggedIn];
}
- (IBAction)cmdTestS3Tapped:(id)sender {
if ([[AmazonClientManager sharedInstance] isLoggedIn]) {
NSLog(@"-----------LOGED IN -------------->");
[self testListBucket];
}
else {
NSLog(@"-----------NOT LOGED IN -------------->");
}
}
- (void)testListBucket {
AWSS3GetObjectRequest *getObjectRequest = [[AWSS3GetObjectRequest alloc] init];
getObjectRequest.key = @"image1.jpg";
getObjectRequest.bucket = @"multix-test";
NSLog(@"============================================>");
//default service has been configured previously
//AWSS3 *s3 = [[AWSS3 new] initWithConfiguration:[AWSServiceManager defaultServiceManager].defaultServiceConfiguration];
AWSS3 *s3 = [AWSS3 defaultS3];
[[s3 getObject:getObjectRequest] continueWithBlock:^id(BFTask *task) {
if(task.error)
{
NSLog(@"Error: %@",task.error);
}
else
{
NSLog(@"Got File");
NSData *data = [task.result body];
NSString *urlString = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
NSURL *url = [[NSURL alloc] initWithString:urlString];
if ([[UIApplication sharedApplication] canOpenURL:url]) {
[[UIApplication sharedApplication] openURL:url];
}
}
return nil;
}];
NSLog(@"============================================>");
}
錯誤
2014-11-26 20:58:24.048 FBLoginTest[2647:83767] initializing clients...
2014-11-26 20:58:24.055 FBLoginTest[2647:83767] -----------LOGED IN -------------->
2014-11-26 20:58:33.542 FBLoginTest[2647:83767] -----------LOGED IN -------------->
2014-11-26 20:58:33.542 FBLoginTest[2647:83767] ============================================>
2014-11-26 20:58:33.551 FBLoginTest[2647:83767] ============================================>
2014-11-26 20:58:33.554 FBLoginTest[2647:88515] AWSiOSSDKv2 [Verbose] AWSURLRequestSerialization.m line:110 | -[AWSJSONRequestSerializer serializeRequest:headers:parameters:] | Request body: [{"IdentityId":"us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx"}]
2014-11-26 20:58:34.870 FBLoginTest[2647:88605] AWSiOSSDKv2 [Debug] AWSURLResponseSerialization.m line:85 | -[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response header: [{
"Content-Length" = 129;
"Content-Type" = "application/x-amz-json-1.1";
Date = "Wed, 26 Nov 2014 16:58:34 GMT";
nnCoection = close;
"x-amzn-RequestId" = "7558584c-758d-11e4-a92d-11020f90ea0e";
}]
2014-11-26 20:58:34.871 FBLoginTest[2647:88605] AWSiOSSDKv2 [Verbose] AWSURLResponseSerialization.m line:90 | -[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body: [{"__type":"NotAuthorizedException","message":"Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx' is forbidden."}]
2014-11-26 20:58:34.873 FBLoginTest[2647:88605] AWSiOSSDKv2 [Error] AWSIdentityProvider.m line:212 | __42-[AWSBasicCognitoIdentityProvider refresh]_block_invoke_2 | GetOpenIdToken failed. Error is [Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=8 "The operation couldn’t be completed. (com.amazonaws.AWSCognitoIdentityErrorDomain error 8.)" UserInfo=0x7fd042491650 {__type=NotAuthorizedException, message=Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx' is forbidden.}]
2014-11-26 20:58:34.873 FBLoginTest[2647:88605] AWSiOSSDKv2 [Error] AWSCredentialsProvider.m line:433 | __40-[AWSCognitoCredentialsProvider refresh]_block_invoke293 | Unable to refresh. Error is [Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=8 "The operation couldn’t be completed. (com.amazonaws.AWSCognitoIdentityErrorDomain error 8.)" UserInfo=0x7fd042491650 {__type=NotAuthorizedException, message=Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx' is forbidden.}]
2014-11-26 20:58:34.873 FBLoginTest[2647:88605] Error: Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=8 "The operation couldn’t be completed. (com.amazonaws.AWSCognitoIdentityErrorDomain error 8.)" UserInfo=0x7fd042491650 {__type=NotAuthorizedException, message=Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx' is forbidden.}
我認為信任關系是不正確的。 它應該是
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated"
}
因為您的用戶已通過Facebook驗證。 您提供的信任關系適用於未經身份驗證的用戶。
有關Cognito,角色和信任關系的更多詳細信息,請參閱Bob的三部分博客
第1部分: http : //mobile.awsblog.com/post/Tx2UQN4KWI6GDJL/Understanding-Amazon-Cognito-Authentication
第2部分: http : //mobile.awsblog.com/post/Tx2FL1QAPDE0UAH/Understanding-Amazon-Cognito-Authentication-Part-2-Developer-Authenticated-Ident
第3部分: http : //mobile.awsblog.com/post/Tx1OSMBRHZVM9V0/Understanding-Amazon-Cognito-Authentication-Part-3-Roles-and-Policies
“禁止訪問身份”錯誤通常是由於無法在憑據提供程序中包含來自登錄提供程序(FB)的令牌。
您沒有包含處理FB登錄的代碼,但我確保您在AWSCognitoCredentials提供程序上正確設置令牌並將該提供程序設置為默認值。
Sebastien的答案仍然很重要,因為如果您使用不正確的角色,您可能會在以后遇到STS錯誤。
謝謝Bob&Sebastien,
問題是。 我忘了把以下代碼放在viewdidload中
[[AmazonClientManager sharedInstance] resumeSessionWithCompletionHandler:^(NSError *error) {
dispatch_async(dispatch_get_main_queue(), ^{
[self refreshUI];
});
}];
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.