AWS Cognito 数据集和 Google Identity Toolkit 错误

Question

我正在使用新的（有点）Google Identity Toolkit，我遇到了一个奇怪的问题。

它生成的JWT令牌如下：

{
  "alg": "RS256",
  "kid": "qwYevA"
}
{
  "iss": "https://identitytoolkit.google.com/",
  "aud": "950882198692-jrb8d5t979qahaechf5gd4t3g59gpvou.apps.googleusercontent.com",
  "iat": 1444275809,
  "exp": 1445485409,
  "user_id": "05244125885327377646",
  "email": "**********@gmail.com",
  "provider_id": "facebook.com",
  "verified": false,
  "display_name": "NOT_MY_NAME",
  "photo_url": "https://fbcdn-profile-a.akamaihd.net/hprofile-ak-xaf1/v/t1.0-1/c155.48.597.597/s50x50/notmyphotonotmyphotonotmyphotonotmyphoto.jpg?oh=notmyphotonotmyphotonotmyphotonotmyphoto&oe=notmyphoto&__gda__=notmyphotonotmyphotonotmyphotonotmyphotonotmyphoto"
} 
{
*signature*
}

我正确设置了iss：

CognitoSyncClientManager.addLogins("https://identitytoolkit.google.com/",
                  idToken.getTokenString());

每当我尝试同步数据集时都会出现错误：

 Dataset dataset = syncClient.openOrCreateDataset("myTestDataset");
    dataset.put("myTestKey", "myTestValue");
    dataset.synchronize(new DefaultSyncCallback() {
        @Override
        public void onSuccess(Dataset dataset, List newRecords) {
            System.out.println(dataset.get("myTestKey"));
        }
    });

错误日志：

com.google.identitytoolkit.demo E/DefaultSyncCallback: Failure occurred during sync
***: com.amazonaws.mobileconnectors.cognito.exceptions.DataStorageException: Failed to list records in dataset: myTestDataset
***:     at com.amazonaws.mobileconnectors.cognito.internal.storage.CognitoSyncStorage.handleException(CognitoSyncStorage.java:293)
***:     at com.amazonaws.mobileconnectors.cognito.internal.storage.CognitoSyncStorage.listUpdates(CognitoSyncStorage.java:152)
***:     at com.amazonaws.mobileconnectors.cognito.DefaultDataset.synchronizeInternal(DefaultDataset.java:388)
***:     at com.amazonaws.mobileconnectors.cognito.DefaultDataset$1.run(DefaultDataset.java:149)
***:     at java.lang.Thread.run(Thread.java:818)
***:  Caused by: com.amazonaws.AmazonServiceException: 1 validation error detected: Value '{https://identitytoolkit.google.com/=eyJhb---*MASSIVE-JWT*---c5demjsRlQtqjz8A}' at 
'logins' failed to satisfy constraint: Map keys must satisfy constraint: [Member must have length less than or equal to 128, Member must have length greater than or equal to 1, 
Member must satisfy regular expression pattern: [\w._/-]+] (Service: AmazonCognitoIdentity; Status Code: 400; Error Code: ValidationException; Request ID: ab0d6028-6d80-11e5-ac9f-33bc83bfc548)
......
***: failed to synchronize myTestDataset

---

那么，我做错了什么？

这是我第一次使用 AWS，而且我对 JWT 也很陌生。任何帮助表示赞赏。

我应该提到我正在使用这个项目中的类和示例：https://github.com/awslabs/aws-sdk-android-samples/tree/master/CognitoSyncDemo

Answer 1

Google 的 OpenID Connect 颁发者名称是“accounts.google.com”，这应该作为 addLogins 的第一个参数传递，而不是 Google 令牌的“https://identitytoolkit.google.com/”。

但是，您的令牌似乎实际上将“https://identitytoolkit.google.com/”指定为颁发者。如果这是您从 Identity Toolkit 收到的那种令牌，恐怕您将无法使用 Cognito 使用它们向 Google 进行身份验证，因为那不是有效的 OpenID Connect 颁发者according to this。这可能值得向 Identity Toolkit 人员询问，因为这看起来像是他们这边的一个错误。