时间戳

首页 > 解决方案 > AWS Cognito 组通过 Amplify (swift)

ios - AWS Cognito 组通过 Amplify (swift)

问题描述

我希望能够使用 Cognito 上的组来启用/禁用我正在构建的应用程序上的某些功能 - 例如，只有编辑器可以编辑。

基本的 Cognito 功能（注册/登录/退出等）有效，但对于我来说，我找不到访问登录用户组的方法。

我正在使用的测试用户是两个组的成员。我有 accessToken 和 idToken，但这里也没有显示任何内容。

_ = Amplify.Auth.fetchAuthSession() { result in
    do {
            let session = try result.get()


            // Get user sub or identity id
            if let identityProvider = session as? AuthCognitoIdentityProvider {

                let usersub = try identityProvider.getUserSub().get()
                let identityId = try identityProvider.getIdentityId().get()

                print("User sub - \(usersub) and identity id \(identityId)")
            }

            // Get aws credentials
            if let awsCredentialsProvider = session as? AuthAWSCredentialsProvider {
                let credentials = try awsCredentialsProvider.getAWSCredentials().get()

                print("Access key - \(credentials.accessKey) ")

            }

            // Get cognito user pool token
            if let cognitoTokenProvider = session as? AuthCognitoTokensProvider {
                print(try cognitoTokenProvider.getCognitoTokens().get().accessToken)
                let tokens = try cognitoTokenProvider.getCognitoTokens().get()
                print("Id token - \(tokens.idToken) ")
            }

        } catch {
            print("Fetch auth session failed with error - \(error)")
        }

}

有任何想法吗？

标签： iosswiftamazon-cognitoaws-amplify

解决方案

您可以通过解析令牌声明来获取与登录用户关联的 Cognito 组，您可以从 id 令牌中检索这些声明。

这是您获得 idToken 后所需要的。首先，获取令牌声明：

let tokenClaims = try AWSAuthService().getTokenClaims(tokenString: tokens.idToken).get()

要从令牌声明中获取 Cognito 组：

if let groups = (tokenClaims["cognito:groups"] as? NSArray) as Array?{
    let cognitoGroups : Set<String> = []
    for group in groups {
        print("Cognito group: \(group)")
        if let groupString = group as? String {
            cognitoGroups.insert(groupString)
        }
    }
 }

把它们放在一起：

_ = Amplify.Auth.fetchAuthSession() { result in
do {
        let session = try result.get()


        // Get user sub or identity id
        if let identityProvider = session as? AuthCognitoIdentityProvider {

            let usersub = try identityProvider.getUserSub().get()
            let identityId = try identityProvider.getIdentityId().get()

            print("User sub - \(usersub) and identity id \(identityId)")
        }

        // Get aws credentials
        if let awsCredentialsProvider = session as? AuthAWSCredentialsProvider {
            let credentials = try awsCredentialsProvider.getAWSCredentials().get()

            print("Access key - \(credentials.accessKey) ")

        }

        // Get cognito user pool token
        if let cognitoTokenProvider = session as? AuthCognitoTokensProvider {
            print(try cognitoTokenProvider.getCognitoTokens().get().accessToken)
            let tokens = try cognitoTokenProvider.getCognitoTokens().get()
            print("Id token - \(tokens.idToken) ")

            let tokenClaims = try AWSAuthService().getTokenClaims(tokenString: tokens.idToken).get()
            print("Token Claims: \(tokenClaims)")
            
            if let groups = (tokenClaims["cognito:groups"] as? NSArray) as Array?{
                let cognitoGroups : Set<String> = []
                for group in groups {
                    print("Cognito group: \(group)")
                    if let groupString = group as? String {
                        cognitoGroups.insert(groupString)
                    }
                }
             }
        }
    } catch {
        print("Fetch auth session failed with error - \(error)")
    }
}

推荐阅读