学习使用 AWS Cognito 并 OAuth2 验证

 1provider "aws" {}
 2
 3resource "aws_cognito_user_pool" "my-demo" {
 4  name = "my-demo"
 5  account_recovery_setting {
 6    recovery_mechanism {
 7      name     = "verified_email"
 8      priority = 1
 9    }
10  }
11  auto_verified_attributes = ["email"]
12  username_configuration {
13    case_sensitive = false
14  }
15  schema {
16    attribute_data_type = "String"
17    name                = "email"
18    required            = true
19  }
20
21  lifecycle {
22    ignore_changes = [schema]
23    prevent_destroy = true
24  }
25}
26
27resource "aws_cognito_user_pool_domain" "my-demo" {
28  domain       = "my-demo-user"
29  user_pool_id = aws_cognito_user_pool.my-demo.id
30}
31
32resource "aws_cognito_user_pool_client" "my-demo" {
33  name         = "my-demo-app"
34  user_pool_id = aws_cognito_user_pool.my-demo.id
35  allowed_oauth_flows_user_pool_client = true
36  callback_urls = [
37    "http://localhost:8080/login/oauth2/token",
38    "https://yanbin.blog/login/oauth2/token"
39  ]
40  logout_urls = [
41    "http://localhost:8080/logout",
42    "https://yanbin.blog/logout"
43  ]
44  supported_identity_providers = ["COGNITO"]
45  allowed_oauth_flows  = ["implicit"]
46  allowed_oauth_scopes = ["email", "openid"]
47  explicit_auth_flows = ["ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_PASSWORD_AUTH"]
48  prevent_user_existence_errors = "ENABLED"
49  enable_token_revocation = true
50  access_token_validity = 1
51  id_token_validity = 1
52
53  token_validity_units {
54    access_token = "hours"
55    id_token = "hours"
56  }
57}
58
59data aws_region current {}
60
61output "cognito" {
62  value = {
63    user_pool_id =aws_cognito_user_pool.my-demo.id
64    app_client_id = aws_cognito_user_pool_client.my-demo.id
65    user_pool_domain = "${aws_cognito_user_pool_domain.my-demo.domain}.auth.${data.aws_region.current.name}.amazoncognitor.com"
66  }
67}

 1from urllib.parse import urlencode
 2
 3cognito_uri = 'https://my-demo-user.auth.us-east-1.amazoncognito.com/login'
 4params = {
 5    'redirect_uri': 'http://localhost:8080/login/oauth2/token',
 6    'response_type': 'token',
 7    'client_id': '539onv6jbhs889k6t0bt13rlgr',
 8    'state': '4I8xO5VVrJP7eiboJhKxCt1DVp5gDtmm', # 随机字符串
 9    'scope': 'openid email'
10}
11
12print(f'{cognito_uri}?{urlencode(params)}')

 1{
 2  "sub": "faa6f254-7405-4db3-bdbd-3dac0590e26b",
 3  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_eu7Gn4LG5",
 4  "version": 2,
 5  "client_id": "539onv6jbhs889k6t0bt13rlgr",
 6  "event_id": "3f8fcc97-d06b-4051-b7a1-b3691d321aa6",
 7  "token_use": "access",
 8  "scope": "openid email",
 9  "auth_time": 1679685185,
10  "exp": 1679688785,
11  "iat": 1679685185,
12  "jti": "7559e70d-0363-40c6-a66c-dd7b276a60c4",
13  "username": "yanbin"
14}

 1{
 2  "at_hash": "XJC1IGvTN1w65CtkyQ-UIA",
 3  "sub": "faa6f254-7405-4db3-bdbd-3dac0590e26b",
 4  "email_verified": true,
 5  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_eu7Gn4LG5",
 6  "cognito:username": "yanbin",
 7  "aud": "539onv6jbhs889k6t0bt13rlgr",
 8  "event_id": "3f8fcc97-d06b-4051-b7a1-b3691d321aa6",
 9  "token_use": "id",
10  "auth_time": 1679685185,
11  "exp": 1679688785,
12  "iat": 1679685185,
13  "jti": "f5d8ebc0-4316-4368-8eec-17aee70b8277",
14  "email": "yabqiu@gmail.com"
15}

 1curl -s -X POST 'https://my-demo-user.auth.us-east-1.amazoncognito.com/oauth2/token' \
 2--header 'Content-Type: application/x-www-form-urlencoded' \
 3--data-urlencode 'grant_type=authorization_code' \
 4--data-urlencode 'client_id=539onv6jbhs889k6t0bt13rlgr' \
 5--data-urlencode 'redirect_uri=http://localhost:8080/login/oauth2/token' \
 6--data-urlencode 'code=106f6ac9-4a26-43f6-9048-9ee005a0fa0e' | jq .
 7{
 8  "id_token": "eyJraWQiOiJtUkdxVXh5STI4cDJ3Znc4b011aElXM2EraTd1Q01P...Bw4mbIqjvoLF8BufE6D_S6wQ",
 9  "access_token": "eyJraWQiOiI3c2k0cDdcLzF3Z2xBK0tLOFQzUHZDW...W78ula7ldlLLpPu_gvZtgXm2lkVzpGg",
10  "refresh_token": "eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNB...CDz4a8vtYBU6og.ct-mI_BWBqDHk4ZayegoGg",
11  "expires_in": 3600,
12  "token_type": "Bearer"
13}

 1curl -s -X POST 'https://my-demo-user.auth.us-east-1.amazoncognito.com/oauth2/token' \
 2--header 'Content-Type: application/x-www-form-urlencoded' \
 3--header 'Cookie: XSRF-TOKEN=c42a7fc6-a764-462f-b67c-23e19ecaa23f' \
 4--data-urlencode 'grant_type=refresh_token' \
 5--data-urlencode 'client_id=539onv6jbhs889k6t0bt13rlgr' \
 6--data-urlencode 'redirect_uri=http://localhost:8080/login/oauth2/token' \
 7--data-urlencode 'refresh_token=eyJjdHkiOiJKV1QiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNB...CDz4a8vtYBU6og.ct-mI_BWBqDHk4ZayegoGg' | jq .
 8{
 9  "id_token": "eyJraWQiOiJtUkdxVXh5STI4cDJ3Znc4b011aElXM2EraTd1...dRs-KggawJVDFiDqDqOaq5RXWIBWp0D8eSMf3-CSIaCNUA",
10  "access_token": "eyJraWQiOiI3c2k0cDdcLzF3Z2xBK0tLOFQzU...bWvpxMKvFMv0f-B1Pe99Il82Oirsufe-tjcjHOucC4gK_fE5YINJw",
11  "expires_in": 3600,
12  "token_type": "Bearer"
13}