AWS Cognito 组通过 Amplify (swift)答案

【问题标题】：AWS Cognito Groups via Amplify (swift)AWS Cognito 组通过 Amplify (swift)
【发布时间】：2021-09-28 22:29:51
【问题描述】：

我希望能够使用 Cognito 上的组来启用/禁用我正在构建的应用程序的某些功能 - 例如，只有编辑者可以编辑。

基本的 Cognito 功能（注册/登录/退出等）可以工作，但在我的一生中，我找不到访问已登录用户组的方法。

我使用的测试用户是两个组的成员。我有 accessToken 和 idToken，但这里也没有显示任何内容。

_ = Amplify.Auth.fetchAuthSession() { result in
    do {
            let session = try result.get()


            // Get user sub or identity id
            if let identityProvider = session as? AuthCognitoIdentityProvider {

                let usersub = try identityProvider.getUserSub().get()
                let identityId = try identityProvider.getIdentityId().get()

                print("User sub - \(usersub) and identity id \(identityId)")
            }

            // Get aws credentials
            if let awsCredentialsProvider = session as? AuthAWSCredentialsProvider {
                let credentials = try awsCredentialsProvider.getAWSCredentials().get()

                print("Access key - \(credentials.accessKey) ")

            }

            // Get cognito user pool token
            if let cognitoTokenProvider = session as? AuthCognitoTokensProvider {
                print(try cognitoTokenProvider.getCognitoTokens().get().accessToken)
                let tokens = try cognitoTokenProvider.getCognitoTokens().get()
                print("Id token - \(tokens.idToken) ")
            }

        } catch {
            print("Fetch auth session failed with error - \(error)")
        }

}

有什么想法吗？

【问题讨论】：

标签： ios swift amazon-cognito aws-amplify

【解决方案1】：

您可以通过解析令牌声明来获取与登录用户关联的 Cognito 组，您可以从 id 令牌中检索这些声明。

这是您获得 idToken 后所需要的。首先，获取 Token Claims：

let tokenClaims = try AWSAuthService().getTokenClaims(tokenString: tokens.idToken).get()

从令牌声明中获取 Cognito 组：

if let groups = (tokenClaims["cognito:groups"] as? NSArray) as Array?{
    let cognitoGroups : Set<String> = []
    for group in groups {
        print("Cognito group: \(group)")
        if let groupString = group as? String {
            cognitoGroups.insert(groupString)
        }
    }
 }

把它们放在一起：

_ = Amplify.Auth.fetchAuthSession() { result in
do {
        let session = try result.get()


        // Get user sub or identity id
        if let identityProvider = session as? AuthCognitoIdentityProvider {

            let usersub = try identityProvider.getUserSub().get()
            let identityId = try identityProvider.getIdentityId().get()

            print("User sub - \(usersub) and identity id \(identityId)")
        }

        // Get aws credentials
        if let awsCredentialsProvider = session as? AuthAWSCredentialsProvider {
            let credentials = try awsCredentialsProvider.getAWSCredentials().get()

            print("Access key - \(credentials.accessKey) ")

        }

        // Get cognito user pool token
        if let cognitoTokenProvider = session as? AuthCognitoTokensProvider {
            print(try cognitoTokenProvider.getCognitoTokens().get().accessToken)
            let tokens = try cognitoTokenProvider.getCognitoTokens().get()
            print("Id token - \(tokens.idToken) ")

            let tokenClaims = try AWSAuthService().getTokenClaims(tokenString: tokens.idToken).get()
            print("Token Claims: \(tokenClaims)")
            
            if let groups = (tokenClaims["cognito:groups"] as? NSArray) as Array?{
                let cognitoGroups : Set<String> = []
                for group in groups {
                    print("Cognito group: \(group)")
                    if let groupString = group as? String {
                        cognitoGroups.insert(groupString)
                    }
                }
             }
        }
    } catch {
        print("Fetch auth session failed with error - \(error)")
    }
}

【讨论】：