如何在 Cognito Federated Identities 中访问用户的电子邮件地址? [英] How to access user's email address in Cognito Federated Identities?

问题描述

我正在尝试建立一个基本网站(AWS 上的无服务器)，允许访问者使用 Google 和/或 Facebook 登录.目前，我计划将 S3、Cognito 与联合身份、API 网关、Lambda (NodeJS) 与 DynamoDB 一起使用.客户端应用将使用 Angular.

I'm trying to set up a basic website (serverless on AWS) that would allow visitors to login with Google and/or Facebook. Currently I'm planning to use S3, Cognito with Federated Identities, API Gateway, Lambda (NodeJS), with DynamoDB. The client app will be using Angular.

我使用 Google 和 Facebook 进行社交登录，目前我在用户第一次登录时在用户"表中插入一行，其中包括 cognitoId、姓名、个人资料图片 URL 等.

I have the social login with Google and Facebook working, and currently I am inserting a row in a "users" table when a user logs in the first time that includes the cognitoId, name, profile picture URL, etc.

我还认为将用户的信息以他们的电子邮件地址作为密钥来存储，而不是像 cognitoId 这样的东西，这样用户可以使用不同的提供者登录并查看相同的数据，这将是一个很好的设计.所以我需要知道经过身份验证的用户的电子邮件地址，但我认为它应该来自 Cognito 而不是直接来自用户(因为不应该信任客户端应用程序).

I also figure it would be a good design to store the user's information with their email address as the key, instead of something like the cognitoId so that the user can login using different Providers and see the same data. So I need to know the authenticated user's email address, but I figure it should come from Cognito and not straight from the user (since the client app shouldn't be trusted).

我相信 Cognito 正在存储用户的电子邮件地址，因为我已根据需要在用户池中启用了该字段.

I believe that Cognito is storing the user's email address because I have enabled that field as required int the User Pool.

我遇到的问题是我找不到有关如何从 Cognito 获取用户电子邮件地址的任何信息.

The issue I'm having is that I cannot find any information about how to get the user's email address from Cognito.

我最接近的是这篇文章，但我在任何地方都找不到访问令牌:如何使用cognito身份id获取用户属性(用户名、电子邮件等)

The closest that I've come is this post, but I can't find the access token anywhere: How to get user attributes (username, email, etc.) using cognito identity id

这篇文章表明我可能可以使用 GetUser，但我又不知道 AccessToken 来自哪里:使用 AWS 认知身份创建用户

This post indicates that I may be able to use GetUser, but I again don't know where the AccessToken comes from: creating user using AWS cognito identity

如果我确实需要使用 GetUser 和 AccessToken，它来自哪里，我如何生成它?它来自客户端，还是我可以使用 AWS.config.credentials 在 Lambda 中获取它?

If I do need to use GetUser and the AccessToken, where does it come from, and how do I generate it? Does it come from the client, or can I get it in Lambda using AWS.config.credentials?

我已经尝试解决这个问题有一段时间了，但我觉得我错过了一些非常简单的东西！

I've been trying to figure this out for a while now and I'm feeling like I'm missing something really simple!

推荐答案

首先，进入 Cognito 身份提供程序(在 Cognito 控制台中)并确保您的提供程序授权范围"是合适的.例如，如果您点击 Google 提供商，您的授权范围可能是个人资料电子邮件 openid".范围因提供商而异，但无论您使用何种范围，它都必须提供对用户电子邮件的访问权限.

Firstly, go into Cognito Identity provider (in the Cognito console) and make sure your provider "Authorize Scope" is suitable. For example if you clicked on the Google provider your Authorize scope might be "profile email openid". The scope will vary by provider, but whatever scope you are using, it must provide access to the users email.

当您的用户使用外部身份提供商(比如 Facebook)登录时，Cognito 会与 Facebook 协商，然后调用您的回调 URL，该 URL 在 Cognito 控制台的应用程序客户端设置"部分中设置.该回调包含一个名为代码"的参数 - 该参数设置在回调的 URL 中，使我的 Cognito.代码是一个 OAuth 令牌.

When your user logs in with an external identity provider (lets say Facebook), Cognito negotiates with Facebook and then calls your Callback URL, which is set in the 'App Client Settings' part of the Cognito console. That Callback contains a parameter called 'code' - the parameter is set in the URL of the Callback made my Cognito. The code is an OAuth token.

现在您的客户端中有一个 OAuth 令牌，您需要将其发布到 AWS 令牌端点.令牌端点返回 响应中的三个新标记；JWT ID 令牌、JWT 访问令牌和刷新令牌.从端点响应中获取id_token"属性.将该 id_token 解析为 json 字符串，并获取 'email' 元素.现在您应该拥有用户的电子邮件地址.

Now you have an OAuth token in your client you need to POST that to the AWS Token Endpoint. The token endpoint returns three new tokens in the response; a JWT ID Token, a JWT Access Token and a refresh token. Take the "id_token" attribute from the endpoint response. Parse that id_token as a json string, and take the 'email' element. Now you should have the users email address.

这是我在 Java 中的工作示例.这是一个被 Cognito 回调调用的 servlet.

Here is my working example in Java. This is a servlet that gets called by the Cognito Callback.

import com.amazonaws.services.dynamodbv2.datamodeling.DynamoDBMapper;
import com.nimbusds.jwt.SignedJWT;
import net.minidev.json.JSONArray;
import org.json.simple.JSONObject;
import org.json.simple.parser.JSONParser;
import org.json.simple.parser.ParseException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.net.URL;
import java.net.URLConnection;

public class CognitoLandingServlet extends HttpServlet {

    static final Logger LOG = LoggerFactory.getLogger(CognitoLandingServlet.class);
    private static final long serialVersionUID = 1L;

    public CognitoLandingServlet() {
        super();
    }

    @Override
    protected void doGet(final HttpServletRequest request, final HttpServletResponse response)
            throws ServletException, IOException {

        // Get the OpenID Connect (OAuth2) token passed back from the hosted Cognito
        // Login Page
        final String code = request.getParameter("code");
        LOG.debug(String.format("Cognito OAuth2 code received from Cognito: %s.", code));

        if (code != null) {
            // do nothing, we have a code as expected
        } else {
            LOG.debug(String.format(
                    "Landing page requested without a Cognito code, the request probably didn't come from Cognito"));
            // we dont have a token so redirect the user to the application sign in
            // page
            request.getRequestDispatcher("/signin").forward(request, response);
        }
        // Exchange the OIDC token for Cognito Access and ID JWT tokens using AWS
        // Token
        // Endpoint
        // There does not appear to be a Java SDK to handle this :(
        final String cognitoClientId = System.getProperty("CognitoClientId");
        final String redirectUri = System.getProperty("CognitoCallBackUrl");
        final String awsTokenEndpoint = System.getProperty("AwsTokenEndpoint");
        final String jwt = swapOauthForJWT(cognitoClientId, code, redirectUri, awsTokenEndpoint);
        // Complete the login using the JWT token string
        loginWithJWT(jwt, request, response);
    }

    @Override
    protected void doPost(final HttpServletRequest request, final HttpServletResponse response)
            throws ServletException, IOException {

    }

    private void loginWithJWT(final String jwtString, final HttpServletRequest request,
                              final HttpServletResponse response) {

        final JSONParser parser = new JSONParser();
        SignedJWT signedIdJWT;

        try {
            // Take the id token
            final JSONObject json = (JSONObject) parser.parse(jwtString);
            final String idToken = (String) json.get("id_token");

            // Access token is not currently used
            // String accessToken = (String) json.get("access_token");

            // Process the id token
            signedIdJWT = SignedJWT.parse(idToken);
            final String userId = signedIdJWT.getJWTClaimsSet().getSubject();

            // Start NEW Session and start adding attributes
            final HttpSession session = request.getSession(true);
            session.setAttribute("userId", userId);

            final String cognitoUsername = (String) signedIdJWT.getJWTClaimsSet()
                    .getClaim("cognito:username");
            if (cognitoUsername != null) {
                user.setUserName(cognitoUsername);
                session.setAttribute("username", cognitoUsername);
            }
            final String email = (String) signedIdJWT.getJWTClaimsSet().getClaim("email");
            if (email != null) {
                user.setEmail(email);
                session.setAttribute("email", email);
            }
            // Save the user to a database (code removed for stack overflow)

            //request.getRequestDispatcher("/dashboard").forward(request, response);
            response.sendRedirect("/dashboard");

            LOG.info(
                    String.format("A user with userid %s and email %s successfully signed in", userId, email));

        } catch (final java.text.ParseException e) {
            LOG.error(
                    String.format("The JWT token could not be parsed by JOSE library. %s", e.getMessage()));
        } catch (final ParseException e) {
            LOG.error(String.format("The JWT token could not be parsed by JSON simple library. %s",
                    e.getMessage()));
        } catch (final IOException e) {
            LOG.error(String.format("Failed to request webpage at the end of the login process - io. %s",
                    e.getMessage()));
        }
    }

    private String swapOauthForJWT(final String cognitoClientId, final String oauthCode,
                                   final String redirectUri, final String awsTokenEndpoint) throws IOException {

        // Build the URL to post to the AWS Token Endpoint
        final String urlParameters = String.format(
                "Content-Type=application/x-www-form-urlencoded&grant_type=authorization_code&client_id=%s&code=%s&redirect_uri=%s",
                cognitoClientId, oauthCode, redirectUri);
        LOG.debug(String.format("User is swapping OAuth token for a JWT using URL %s", urlParameters));
        final URL url = new URL(awsTokenEndpoint);
        final URLConnection conn = url.openConnection();
        conn.setDoOutput(true);
        final OutputStreamWriter writer = new OutputStreamWriter(conn.getOutputStream());
        writer.write(urlParameters);
        writer.flush();
        // Read the data returned from the AWS Token Endpoint
        final BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream()));
        final StringBuilder responseStrBuilder = new StringBuilder();
        String inputStr;
        while ((inputStr = reader.readLine()) != null) {
            responseStrBuilder.append(inputStr);
        }
        // Close the connection
        writer.close();
        reader.close();
        LOG.debug(String.format("Finished swapping OAuth token for a JWT"));

        return responseStrBuilder.toString();
    }
}

这篇关于如何在 Cognito Federated Identities 中访问用户的电子邮件地址?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！