amazon-cognito | 易学教程

AWS cognito: What's the difference between Access and Identity tokens?

阅读更多关于 AWS cognito: What's the difference between Access and Identity tokens?

问题 Just reading the docs, they seem very similar to me so I can't really discern why to use one over the other. Although identity token seems better since it has custom attributes on it from the user pool (eg: custom:blah and the default ones like name and email ). Right now, I am working with an app that passes the access token back down to the browser so it can use it for making ajax REST calls (there is an auth filter that expects this access token and validates it). Could I just switch out

How to call AWS API Gateway Endpoint with Cognito Id (+configuration)?

阅读更多关于 How to call AWS API Gateway Endpoint with Cognito Id (+configuration)?

I want to call an AWS API Gateway Endpoint that is protected with AWS_IAM using the generated JavaScript API SDK . I have a Cognito UserPool and a Cognito Identity Pool . Both properly synced via ClientId . I use this code to Sign in and get the Cognito Identity AWS.config.region = 'us-east-1'; // Region AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXXXXXX' // your identity pool id here }); AWSCognito.config.region = 'us-east-1'; AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: 'us-east-1

AmazonServiceException: User is not authorized to perform: dynamodb:DescribeTable Status Code: 400; Error Code: AccessDeniedException

阅读更多关于 AmazonServiceException: User is not authorized to perform: dynamodb:DescribeTable Status Code: 400; Error Code: AccessDeniedException

问题 I had originally thought that this issue was due to mismatching regions, but after changing the region, I'm still coming across the following error when trying out an Amazon AWS sample found here: DynamoDBMapper AmazonServiceException: User: arn:aws:sts::[My Account ARN]:assumed-role/Cognito_AndroidAppUnauth_DefaultRole/ProviderSession is not authorized to perform: dynamodb:DescribeTable on resource: arn:aws:dynamodb:us-east-1:[My Account ARN]:table/test_table (Service: AmazonDynamoDBv2;

AWS Cognito - User stuck in CONFIRMED and email_verified = false

阅读更多关于 AWS Cognito - User stuck in CONFIRMED and email_verified = false

问题 How do I go about email verifying a user who is CONFIRMED yet email_verified is false? The scenario is roughly an agent signs up user on their behalf, and I confirm the user through the admin call adminConfirmSignUp. At that point, the user cannot change their password because of the email_verified flag being false. I can't call resendConfirmationCode because the user is already confirmed. I can't call forgotPassword because the email_verified flag is false. The best I can think of is

Where to find Identity Pool Id in Cognito

阅读更多关于 Where to find Identity Pool Id in Cognito

Where is Identity Pool in Cognito Console. As said in docs it has format: IdentityPoolId An identity pool ID in the format REGION:GUID. But I see only Pool Id and Pool ARN in the console. Which has different format. I can manage to get the IdentityPooId by aws cli: aws cognito-identity list-identity-pools --max-results 10 The command returns all of the Cognito identity pools registered for your account. { "IdentityPools": [ { "IdentityPoolId": "XX-XXXX-X:XXXXXXXX-XXXX-1234-abcd-1234567890ab", "IdentityPoolName": "<some custom name>" } ] } You can find Identity pool ID if you select Manage

AWS Cognito - Developer Authenticated Identities in JavaScript(Browser)

阅读更多关于 AWS Cognito - Developer Authenticated Identities in JavaScript(Browser)

问题 I have trouble getting credentials in a browser script. The authentication server returns cognito_identityId and cognito_token. Then I set a Cookie: $.cookie('cognito_identityId') $.cookie('cognito_token') I tried to get credentials in 4 ways on the browser, and all Failed: CognitoIdentityCredentials AWS.config.credentials = new AWS.CognitoIdentityCredentials({ IdentityPoolId: 'us-east-1:xxxxxxxxxxxx' IdentityId: $.cookie('cognito_identityId'), Logins: { 'myauth': $.cookie('cognito_token') }

Amazon Cognito developer authenticated identity with Java SDK

阅读更多关于 Amazon Cognito developer authenticated identity with Java SDK

I am trying to authenticate a java app to AWS services using a developer-authenticated Cognito identity. This is very straightforward in the AWS mobile SDKs ( documentation ), but I can't seem to find the equivalent classes in the Java SDK. The main issue I am having is that the Java SDK classes (such as WebIdentityFederationSessionCredentialsProvider) require the client code to know the arn of the role being assumed. With the mobile SDK, it uses the role configured for the federated identity. That's what I'd prefer to do, but it seems the Java SDK doesn't have the supporting classes for that.

Cannot set a property of cognito userpool client via cloudformation

阅读更多关于 Cannot set a property of cognito userpool client via cloudformation

I am trying to run congnito via cloudformation and everything works but there is section in cognito as follows: As you see there is section "Enable identity providers" and I can not find where I can set it to my cognito user pool in cloudformation! I tried this attributes but it says not supported. SupportedIdentityProviders Here is my code for user pool client: UserPoolClient: Type: "AWS::Cognito::UserPoolClient" Properties: ClientName: !Sub ${project}-client ExplicitAuthFlows: - ADMIN_NO_SRP_AUTH - USER_PASSWORD_AUTH GenerateSecret: false UserPoolId: !Ref UserPool RefreshTokenValidity: 30

how to use AWS cognito with custom authentication to create temporary s3 upload security token

阅读更多关于 how to use AWS cognito with custom authentication to create temporary s3 upload security token

So I'm a bit confused by the Amazon documentation on Cognito concerning one of their stated use cases: "use your own identity system... allowing your apps to save data to the AWS cloud". In my case I want to give them aws tokens to upload directly to s3 from the mobile client without putting my aws keys on the client device. In order to implement this on the server side - how do I generate the proper credentials so that the client can use this identity on the client app to upload to s3? Do I first call getId() (what values do I pass if I'm using my own login - since I'm not providing a

AWS iOS SDK Cognito Developer Authentication (Swift)

阅读更多关于 AWS iOS SDK Cognito Developer Authentication (Swift)

问题 I am having a hard time figuring out how to return developer credentials provided by my server (via AWS) to my Example identity provider. It seems I need to do this synchronously within the refresh method on the ExampleIdentityProvider class. I'm using AFNetworking to make the request, but it is an async GET request. How can I do this synchronously for the refresh method on my IdentityProvider? The following is in Swift: class ExampleIdentityProvider: AWSAbstractIdentityProvider { var