可以通过在AWS Cognito控制台中手动添加声明的映射来解决此问题,或者在AWS Lambda函数中使用AWS SDK实现自定义声明映射。以下是使用AWS SDK实现自定义声明映射的示例:
const AWS = require('aws-sdk');
const cognitoidentity = new AWS.CognitoIdentity();
exports.handler = async (event, context) => {
const accessToken = event.accessToken;
const identityId = event.identityId;
const params = {
IdentityId: identityId,
Logins: {
'LOGIN_PROVIDER_NAME': accessToken
}
};
const {Credentials} = await cognitoidentity.getCredentialsForIdentity(params).promise();
const { assumeRoleWithWebIdentity } = new AWS.STS();
const roleArn = 'arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME'; // Replace with actual role ARN
const sessionName = 'MySession'; // Replace with any session name
const assumeRoleParams = {
RoleArn: roleArn,
RoleSessionName: sessionName,
WebIdentityToken: accessToken,
DurationSeconds: 3600,
};
const { Credentials: WebIdentityCredentials } = await assumeRoleWithWebIdentity(assumeRoleParams).promise();
// Add custom mapping logic for claims
const customClaims = {
'custom:Department': 'Marketing'
};
const {IdentityPoolId} = process.env;
const { updateIdentityPool } = new AWS.CognitoIdentity({region: 'us-east-1'});
const identityPoolParams = {
AllowUnauthenticatedIdentities: false,
IdentityPoolId: IdentityPoolId,
IdentityProviderConfigs: [
{
ProviderName: "LOGIN_PROVIDER_NAME",
ProviderDetails: {},
AttributeMapping: {
"custom:Department": "department"
}
}
]
};
await updateIdentityPool(identityPoolParams).promise();
return {
statusCode: 200,
body: JSON.stringify({
Credentials,
WebIdentityCredentials
})
};
};
上一篇:AWSCognitooauth2/tokenpostingthedataerror(Unauthorizedclienterror)
下一篇:AWSCognitoPHPrespondToAuthChallengeNEW_PASSWORD_REQUIREDUserAttributesMissing