How to replace Cognito with Authing and AWS JWT Authorizer-Safety-php.cn

How to replace Cognito with Authing and AWS JWT Authorizer

WBOY

Release： 2023-05-27 13:41:15

forward

791 people have browsed it

Use Authing's OIDC Provider as the authenticator for AWS API Gateway to protect Lambda functions. There is no need to write any authentication code, just configure it on both sides. It also demonstrates Authing's ability to issue OIDC IdToken for custom fields based on different contexts.

Authing console configuration

##Visit https://console.authing.cn and register an account

如何使用Authing和AWS JWT Authorizer替换Cognito

Create a user pool

如何使用Authing和AWS JWT Authorizer替换Cognito

Create an application

如何使用Authing和AWS JWT Authorizer替换Cognito

Find the application you just created in the application list and click Configure. Select RS256 for Signature Algorithm below.

Create User

Enter

User Management> User List, click the New button in the upper right corner, create two users, and finally click Save.

如何使用Authing和AWS JWT Authorizer替换Cognito

Set Token custom field

Enter

Extension capabilities> Pipeline Pipeline, click the plus sign below at the "Before OIDC issues Token" position on the far right.

如何使用Authing和AWS JWT Authorizer替换Cognito

Choose to add a custom IdToken.

如何使用Authing和AWS JWT Authorizer替换Cognito

#In the pop-up drawer, enter the following custom code to customize the Token field. Finally click upload.

async function pipe(user, context, callback) {
  if(user.email === 'sample@sample.com') {
    user.addIdToken("companyCode", "sample")
  }
  if(user.email === 'sample2@sample.com') {
    user.addIdToken("companyCode", "sample2")
  }
  callback(null, user, context)
}

Copy after login

如何使用Authing和AWS JWT Authorizer替换Cognito

AWS console configuration

Create API Gateway

Enter the AWS API Gateway console and click "Create API".

如何使用Authing和AWS JWT Authorizer替换Cognito

Select HTTP API and click "Build".

如何使用Authing和AWS JWT Authorizer替换Cognito

Fill in the API name and click "Next".

如何使用Authing和AWS JWT Authorizer替换Cognito

Click "Next".

如何使用Authing和AWS JWT Authorizer替换Cognito

Click "Next"

如何使用Authing和AWS JWT Authorizer替换Cognito

Click "Create".

如何使用Authing和AWS JWT Authorizer替换Cognito

Create a Lambda function

Enter the AWS Lambda console and click "Create Function".

如何使用Authing和AWS JWT Authorizer替换Cognito

Create the Lambda function as shown below. The function name can be filled in arbitrarily.

如何使用Authing和AWS JWT Authorizer替换Cognito

Add a trigger for the Lambda function

如何使用Authing和AWS JWT Authorizer替换Cognito

Select API Gateway.

如何使用Authing和AWS JWT Authorizer替换Cognito

Select the API Gateway you just created and click "Add".

如何使用Authing和AWS JWT Authorizer替换Cognito

点击 Lambda 函数，向下滚动浏览器窗口，进入编辑界面。

如何使用Authing和AWS JWT Authorizer替换Cognito

输入以下代码，用于返回 Token 中的信息，包括 companyCode。

exports.handler = async (event) => {
    // TODO implement
    const token = event.headers.authorization.replace('Bearer ', '');
    const claims = event.requestContext.authorizer.claims;
    const response = {
        statusCode: 200,
        body: JSON.stringify({
            token,
            claims,
            companyCode: claims.companyCode
        })
    
    };
    return response;
};

Copy after login

最后点击「Deploy」。

如何使用Authing和AWS JWT Authorizer替换Cognito

设置 API Gateway 路由 Authorizer

进入 AWS API Gateway 控制台，找到刚创建的 API。

如何使用Authing和AWS JWT Authorizer替换Cognito

找到刚刚为 Lambda 函数设置的触发器路由，点击「附加授权」。

如何使用Authing和AWS JWT Authorizer替换Cognito

点击「创建并附加授权方」。

如何使用Authing和AWS JWT Authorizer替换Cognito

选择 JWT 授权方类型

如何使用Authing和AWS JWT Authorizer替换Cognito

授权方按照以下方式设置。

如何使用Authing和AWS JWT Authorizer替换Cognito

上面的信息可以在 Authing 控制台找到：

在应用> 应用列表，找到你的应用，点击「配置」。

如何使用Authing和AWS JWT Authorizer替换Cognito

发布者 URL 填写这里的 Issuer，受众填写应用 ID。

如何使用Authing和AWS JWT Authorizer替换Cognito

最后点击「创建并附加」。

如何使用Authing和AWS JWT Authorizer替换Cognito

到此所有配置完毕

登录示例

安装 NodeJS

http://nodejs.cn/download/

克隆项目

git clone https://git.authing.co/yezuwei/sample-poc

安装依赖

cd sample-poc
npm install

Copy after login

运行

node bin/www

然后在浏览器访问 https://kone.authing.cn

在登录页面输入账号和密码

如何使用Authing和AWS JWT Authorizer替换Cognito

收到来自 Lambda 的响应：

如何使用Authing和AWS JWT Authorizer替换Cognito

点击登出，再使用账号和密码登录

如何使用Authing和AWS JWT Authorizer替换Cognito

收到来自 Lambda 的响应：

如何使用Authing和AWS JWT Authorizer替换Cognito

注意 companyCode 已经根据用户的信息字段，进行逻辑判断然后返回了另外一个。

The above is the detailed content of How to replace Cognito with Authing and AWS JWT Authorizer. For more information, please follow other related articles on the PHP Chinese website!