0

我正在开发一个firebase authentication用于登录和使用AWS S3以及dynamodb管理数据/图像的 android 应用程序。我正在尝试通过AWSAssumeRoleWebIdentity. 我这样做的原因是AWS Sign-In UI不允许对 UI 和 UI 流进行足够的自定义。我决定firebase authentication仅用于登录和注册。

请找到源代码和OIDC Provider设置。有了他们，错误日志是

No OpenIDConnect provider found in your account for https://securetoken.google.com/[project-name] (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken; Request ID: 37607060-9e1c-11e8-8ae0-636eae27c3bf)

已创建名为“securetoken.google.com/[my-project-name]/”的身份提供程序，AWS IAM其中我创建的指纹指的是 [1] 和在 中获得的 OAuth 2.0 客户端CredentialsID Google Cloud Service API & Services。

源代码如下所示。

public void uploadImageFile() {
    CustomLog.logI("start of uploadImageFile");

    setIDToken();
}

private void setIDToken() {
    FirebaseUser mUser = FirebaseAuth.getInstance().getCurrentUser();
    // To get ID Token of the user authenticated by google authentication
    mUser.getIdToken(true)
            .addOnCompleteListener(new OnCompleteListener<GetTokenResult>() {
                public void onComplete (@NonNull Task< GetTokenResult > task) {
                    if (task.isSuccessful()) {
                        // Token information is set to mIDToken of the global variable
                        mIDToken = task.getResult().getToken();
                        AsyncTaskForAssumeRole asyncTaskForAssumeRole = new AsyncTaskForAssumeRole();
                        asyncTaskForAssumeRole.execute();
                    } else {
                        CustomLog.logE(task.getException().getMessage());
                    }
                }
            });
}

public class AsyncTaskForAssumeRole extends AsyncTask<Void, Void, BasicSessionCredentials> {

    protected BasicSessionCredentials doInBackground(Void... params) {
        try {
            // set credentials from AssumeRoleWithWebIdentity
            BasicSessionCredentials credentials = setAssumeRoleWithWebIdentity();
            return credentials;
        } catch (Exception e) {
            CustomLog.logE(e.getMessage());
            return null;
        }
    }

    protected void onPostExecute(BasicSessionCredentials credentials) {

        // upload file with S3 connection
        connectToS3ForUpload(credentials);

    }
}

private BasicSessionCredentials setAssumeRoleWithWebIdentity(){
    CustomLog.logD("start of setAssumeRoleWithWebIdentity");
    String ROLE_ARN = [my role arn];
    // set AssumeRoleWithWebIdentity request with created policy and token information retrieved through Google Sign in information
    AssumeRoleWithWebIdentityRequest request = new AssumeRoleWithWebIdentityRequest()
            .withWebIdentityToken(mIDToken)
            .withRoleArn(ROLE_ARN)
            .withRoleSessionName("wifsession");

    BasicAWSCredentials basicCreds = new BasicAWSCredentials("", "");
    AWSSecurityTokenServiceClient sts = new AWSSecurityTokenServiceClient(basicCreds);
    AssumeRoleWithWebIdentityResult result = sts.assumeRoleWithWebIdentity(request);

    Credentials stsCredentials = result.getCredentials();
    String subjectFromWIF = result.getSubjectFromWebIdentityToken();
    BasicSessionCredentials credentials = new BasicSessionCredentials(stsCredentials.getAccessKeyId(),
            stsCredentials.getSecretAccessKey(),
            stsCredentials.getSessionToken());

    return credentials;
}

非常感谢提前。

[1] http://docs.aws.amazon.com/cli/latest/reference/iam/create-open-id-connect-provider.html

4

1 回答 1

1

考虑使用 Amazon Cognito 联合身份（身份池）将用户从您的身份提供者联合（映射）到 Amazon Cognito 并获取可用于授权访问 AWS 资源的 Cognito 身份 ID。有关详细信息，请参阅https://docs.aws.amazon.com/cognito/latest/developerguide/open-id.html。

Map<String, String> logins = new HashMap<String, String>();
logins.put("login.provider.com", token);
credentialsProvider.setLogins(logins);

现在，您可以将该credentialsProvider对象与 Amazon S3 客户端一起使用。

AmazonS3 s3Client = new AmazonS3Client(getApplicationContext(), credentialsProvider);
于 2018-08-13T03:12:06.217 回答