代码更新：AWS Cognito用户标识池授权？目标-C

Question

所以我一直在试图弄明白这一点，但文档不够清晰。

我正在尝试使用AWS cognito用户池和联邦身份池。

在网上，他们说你可以连接这两个人，然后通过你的用户池验证用户，从你的身份池获得证书。现在我已经将它们连接起来，它显示为授权方法，但我无法弄清楚在目标c中要做什么才能让它工作。我只能让未经授权的用户进入我的联邦身份池，而不是授权用户。

我还负责用户池的所有工作（创建和验证用户），因此只需将他们放入联邦身份池中获取权限。

有人可以在objective-c中发布一个代码示例来说明如何实现它吗？或者带我走一下如何做的逻辑步骤？

我一直在看这些链接：http://mobile.awsblog.com/post/TxGNH1AUKDRZDH/Announcing-Your-User-Pools-in-Amazon-Cognito

如何将Cognito用户池与Facebook等外部提供商相结合？

几乎每一个aws链接

这里的问题的更新是一些代码：

我能够注册和验证用户，但是它没有在用户联合身份池的控制台上注册，只有未经身份验证。这是我的AWSServiceConfiguration的问题吗？（等）

这是我们用来创建用户的注册方法

RCT_EXPORT_METHOD(submitUser: (NSString*) email and:

                         (NSString*) gender and:

                         (NSString*) name and:

                         (NSString*) nickname and:

                         (NSString*) picture and:

                         (NSString*) phone_number and:

                         (NSString*) preferred_username and:

                         (NSString*) hashedPass and:

                         (RCTResponseSenderBlock)callback){



  AWSCognitoIdentityUserPool *pool = [AWSCognitoIdentityUserPool CognitoIdentityUserPoolForKey:@"UserPool"];





  NSMutableArray * attributes = [NSMutableArray new];

  AWSCognitoIdentityUserAttributeType * userEmail = [AWSCognitoIdentityUserAttributeType new];

  userEmail.name = @"email";

  userEmail.value = email;

  AWSCognitoIdentityUserAttributeType * userGender = [AWSCognitoIdentityUserAttributeType new];

  userGender.name = @"gender";

  userGender.value = gender;

  AWSCognitoIdentityUserAttributeType * userName = [AWSCognitoIdentityUserAttributeType new];

  userName.name = @"name";

  userName.value = name;

  AWSCognitoIdentityUserAttributeType * userNickname = [AWSCognitoIdentityUserAttributeType new];

  userNickname.name = @"nickname";

  userNickname.value = nickname;

  AWSCognitoIdentityUserAttributeType * userPicture = [AWSCognitoIdentityUserAttributeType new];

  userPicture.name = @"picture";

  userPicture.value = picture;

  AWSCognitoIdentityUserAttributeType * userPhone = [AWSCognitoIdentityUserAttributeType new];

  userPhone.name = @"phone_number";

  userPhone.value = phone_number;

  AWSCognitoIdentityUserAttributeType * userPreferredUsername = [AWSCognitoIdentityUserAttributeType new];

  userPreferredUsername.name = @"preferred_username";

  userPreferredUsername.value = preferred_username;



  [attributes addObject:userEmail];

  [attributes addObject:userGender];

  [attributes addObject:userName];

  [attributes addObject:userNickname];

  [attributes addObject:userPicture];

  [attributes addObject:userPhone];

  [attributes addObject:userPreferredUsername];


  NSMutableString *str = [NSMutableString string];

  [str appendString:name]; 

  [str appendString:name];

  NSString *immutableString = str;  // Change later to unique identifier


  [[pool signUp:immutableString password:html" target="_blank">hashedPass userAttributes:attributes validationData:nil]

   continueWithBlock:^id(AWSTask<AWSCognitoIdentityUser*> *task) {

    if (task.error) {

      RCTLog(@"Error: %@", task.error);

    }

    if (task.exception) {

      RCTLog(@"Exception: %@", task.exception);

    }

    if (task.result) {

      RCTLog(@"Successfully registered user: %@",task.result);

    }

    callback(@[[NSNull null],@NO]);

    return nil;  

      }];

}

使用电子邮件代码方法验证用户

RCT_EXPORT_METHOD(verifyUser:(nonnull NSString *)userName and:

                             (nonnull NSString *)code and:

                             (RCTResponseSenderBlock)callback) {



  AWSCognitoIdentityUserPool *pool = [AWSCognitoIdentityUserPool CognitoIdentityUserPoolForKey:@"UserPool"];

  AWSCognitoIdentityUser * user = [pool getUser:userName];




  [[user confirmSignUp:code] continueWithBlock:^id(AWSTask<AWSCognitoIdentityProviderConfirmSignUpResponse*> *task) {

    bool pass = NO;    

    if(task.error){

       RCTLog(@"Error: %@", task.error);

    }

    else if(task.exception){

       RCTLog(@"Exception: %@", task.exception);

    }

    else{

       RCTLog(@"Successfully confirmed user: %@",user.username); pass = YES;

    }

    // Return TRUE If Succead

    if(pass){

      callback(@[[NSNull null],@YES]);

    }

    else{

      callback(@[[NSNull null],@NO]);

    }

    return nil;

  }];


}

在Appdelegate.m中

AWSServiceConfiguration *serviceConfiguration = [[AWSServiceConfiguration alloc] initWithRegion:AWSRegionUSEast1 credentialsProvider:nil];

  AWSCognitoIdentityUserPoolConfiguration *configuration = [[AWSCognitoIdentityUserPoolConfiguration alloc]

                                                            initWithClientId:@"clientidhere"

                                                            clientSecret:@"clientsecrethere"

                                                            poolId:@"poolidhere"];



  [AWSCognitoIdentityUserPool registerCognitoIdentityUserPoolWithConfiguration:serviceConfiguration userPoolConfiguration:configuration forKey:@"UserPool"];



  AWSCognitoCredentialsProvider *credentialsProvider = [[AWSCognitoCredentialsProvider alloc]

                                                        initWithRegionType:AWSRegionUSEast1

                                                        identityPoolId:@"identitypoolIDhere"];







  AWSServiceConfiguration *config = [[AWSServiceConfiguration alloc] initWithRegion:AWSRegionUSEast1 credentialsProvider:credentialsProvider];

  [AWSServiceManager defaultServiceManager].defaultServiceConfiguration = config;



  [AWSSQS registerSQSWithConfiguration:config forKey:@"USWest2SQS"]; // Needed for sqs work throughout the app

Answer 1

我解决了这个问题，提供了一个自定义标识提供商

@interface CustomIdentityProvider : NSObject <AWSIdentityProviderManager>
  @property (nonatomic, retain) NSDictionary *tokens;
  - (AWSTask *) logins;
@end

@implementation CustomIdentityProvider

- (AWSTask *) logins {
    AWSTask *task = nil;

    if (nil != self.tokens) {
        return [AWSTask taskWithResult:self.tokens];
    }

    return task;
}

@end

创建AWSCognitoCredentialsProvider时，需要分配identityProviderManager

self.identityProviderManager = [[CustomIdentityProvider alloc] init];

self.credentialsProvider = [[AWSCognitoCredentialsProvider alloc]
                            initWithRegionType:AWSRegionUSEast1
                            identityPoolId:self.identityPoolId
                             identityProviderManager:self.identityProviderManager];

一旦设置好了此项，就需要填充令牌字典。这是在调用getSession并获取AWSCognitoIdentityUserSession后完成的。

AWSCognitoIdentityUserSession *session;  // Obtained from getSession
NSString *userPoolName = [NSString stringWithFormat:@"cognito-idp.us-east-1.amazonaws.com/%@", self.poolId];
NSDictionary *dict = @{userPoolName : session.idToken.tokenString};
self.customIdentityProvider.tokens = dict;

假设您是通过API网关中的SDKGeneration功能生成AWSApigateway客户端代码，那么您应该已经做好了所有设置，可以作为经过身份验证的用户进行API网关调用。

（请注意，不要忘记配置您的联合身份，为经过身份验证的用户设置IAMS角色，以允许执行api:Invoke。）