AWS：如何根据Cognito池正确验证用户，并将其用于Cognito联合身份？

Question

我正在开发一个应用程序，它将使用两个身份验证提供商：

• Facebook
• Cognito用户池

与前者，我没有问题，一切正常。然而，在使用Cognito用户池设置身份验证时，我遇到了一堵又一堵墙。我使用的是AWS SDK 2.4.9、XCode 8和Swift 3。

我意识到已经有人问了很多问题，而且有很多“指南”。然而，其中很多都是为过时的文档和SDK回答/制作的。甚至官方的AWS留档也过时了。

我正在经历的身份验证步骤如下：

1.配置初始cognito池

///  Set the default service configuration
let serviceConfiguration = AWSServiceConfiguration(region: AWSRegionType.usEast1, credentialsProvider: nil)
AWSServiceManager.default().defaultServiceConfiguration = serviceConfiguration

/// Create a pool configuration and register it for a specific key to use later
let poolConfiguration = AWSCognitoIdentityUserPoolConfiguration(clientId: appClientID, clientSecret: appClientSecret, poolId: poolID)  
AWSCognitoIdentityUserPool.registerCognitoIdentityUserPool(with: poolConfiguration, forKey: poolKey)

/// Create a pool for a specific predefined key
pool = AWSCognitoIdentityUserPool(forKey: poolKey)

2.根据Cognito用户池验证用户

  user.getSession(username, password: password, validationData: nil).continue({ (task) -> AnyObject? in

        if let error = task.error as? NSError {
            completionHandler(error)
            return nil
        }

        let session = task.result! as AWSCognitoIdentityUserSession
        let token = session.idToken!.tokenString

        let tokens : [NSString:NSString] = ["cognito-idp.us-east-1.amazonaws.com/\(self.poolID!)" as NSString : token as NSString]
        let identityProvider = CognitoPoolIdentityProvider(tokens: tokens)

        let credentialsProvider = AWSCognitoCredentialsProvider(regionType: .usEast1, identityPoolId: self.identityPoolID, identityProviderManager: identityProvider)

        ///  Set the default service configuration
        let serviceConfiguration = AWSServiceConfiguration(region: AWSRegionType.usEast1, credentialsProvider: credentialsProvider)
        AWSServiceManager.default().defaultServiceConfiguration = serviceConfiguration

        credentialsProvider.getIdentityId().continue({ (task) -> AnyObject? in
            completionHandler(task.error as NSError?)
            return nil
        })

        return nil
    })

3.CognitoPoolIdentityProvider类

    class CognitoPoolIdentityProvider : NSObject, AWSIdentityProviderManager {

      var tokens : NSDictionary = [:]

      init(tokens: [NSString : NSString]) {
           self.tokens = tokens as NSDictionary
      }

      @objc func logins() -> AWSTask<NSDictionary> {
           return AWSTask(result: tokens)
      }

    }

4.将数据存储到Cognito联合身份

这一切都毫无差错地过去了。然而，现在我想存储我从Cognito池中提取到特定的Cognito联合身份数据集的数据，所以我调用：userProfile.synchronize（）。继续，我得到以下结果：

getCredentialsWithCognito:authenticated:customRoleArn:_block_invoke | GetCredentialsForIdentity失败。错误为[Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=8”（null）“UserInfo={{uuuu type=NotAuthorizedException，message=Access-Identity'us-east-1:xxxxxxxxxxxxxxxx-xxxx-xxxx-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx'被禁止。}]

2016-11-10 10:27:16.947365xxxxxxxx[19867:5614838]AWSiOSSDK v2.4.11[错误]AWS标识符提供程序. m line： 304|__52-[AWSCognitoCreentialsProviderHelper getIdtyId]_block_invoke.255|GetId失败。错误是[Error Domain=com.amazonaws.AWSCognitoIdtyErrorDomain Code=8"（null）"UserInfo={__type=NotAuthorizedExc0019，消息=此标识池不支持未经身份验证的访问。}]2016-11-10 10:27:16.947726xxxxxxxx[19867:5614838]AWSiOSSDK v2.4.11[错误]

行：577|__44-[AWSCognitoCre的提供者凭据]_block_invoke.352|无法刷新。错误是[Error Domain=com.amazonaws.AWSCognitoIdtyErrorDomain Code=8"（null）"UserInfo={__type=NotAuthorizedExc0019，消息=此标识池不支持未经验证的访问。}]2016-11-10 10:27:16.948452xxxxxxxx[19867:5614838]AWSiOSSDK v2.4.11[错误]

AWSCognitoDataset. m line： 352|__30-[AWSCognitoDataset syncPull：]_block_invoke|无法列出记录：Error Domain=com.amazonaws.AWSCognitoIdtyErrorDomain Code=8"（null）"UserInfo={__type=NotAuthorizedExc农田，消息=此标识池不支持未经身份验证的访问。}[10:27:16]：保存设置AWS任务错误：操作无法完成。（com.amazonaws.AWSCognito标识符错误域错误8。）

更改日志级别后，我可以看到以下内容：

//请求

2016-11-10 10:33:08.095735 xxxxxxxx[19874:5616142]AWSIOSDK v2.4.11[Debug]AWSURLSessionManager.m行：543 |-[AWSURLSessionManager printHTTPHeadersAndBodyForRequest:|请求主体：{“IdentityId:”us-east-1:XXXXXXXXXXXXXXXX-xxxx-xxxx-xxxx-xxxx-xxxxxxxx-XXXXXXXXXXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXX”}

//响应

2016-11-10 10:33:08.714268xxxxxxxx[19874:5616154]AWSiOSSDK v2.4.11[Debug]AWSURLSessionManager. m line： 553|-[AWSURLSessionManager printHTTPHeadersFor响应：]|响应报头：{连接="保持活力"；"内容长度"=129；"内容类型"="应用程序/x-amz-json-1.1"；日期="Thu，10 Nov2016 09:33:08GMT"；"x-amzn-错误消息"="禁止访问身份'us-East-1： xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx'."；"x-amzn-错误类型"="NotAuthorizedExcture："；"x-amzn-请求ID"="b0ac6fb0-a728-11e6-8413-1fdb846185bb"；}

上面的请求是getIDAPI调用。显然，它与AWS文档中的请求格式不匹配：http://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetId.html.

根据AWSServiceManager类，我们有：

/**
 The default service configuration object. This property can be set only once, and any subsequent setters are ignored.
 */
@property (nonatomic, copy) AWSServiceConfiguration *defaultServiceConfiguration;

这意味着设置新的服务配置毫无意义，但我认为没有其他方法可以刷新通过Cognito用户池身份验证获得的凭据。

差不多就是这样。有什么想法吗？

谢谢

Answer 1

从你所犯的错误来看

  Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' is forbidden

您在第一部分中获得的凭据无法访问您进行同步调用的身份，因此您的身份可能已更改。