无法验证 Amazon Cognito 用户池中客户端的秘密哈希

Unable to verify secret hash for client in Amazon Cognito Userpools

我卡在了 "Amazon Cognito Identity user pools" 进程中。

我尝试了所有可能的代码来验证 Cognito 用户池中的用户。但我总是收到错误消息 "Error: Unable to verify secret hash for client 4b*******fd".

代码如下:

AWS.config.region = 'us-east-1'; // Region
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'us-east-1:b64bb629-ec73-4569-91eb-0d950f854f4f'
});

AWSCognito.config.region = 'us-east-1';
AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'us-east-1:b6b629-er73-9969-91eb-0dfffff445d'
});

AWSCognito.config.update({accessKeyId: 'AKIAJNYLRONAKTKBXGMWA', secretAccessKey: 'PITHVAS5/UBADLU/dHITesd7ilsBCm'})

var poolData = { 
    UserPoolId : 'us-east-1_l2arPB10',
    ClientId : '4bmsrr65ah3oas5d4sd54st11k'
};
var userPool = new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(poolData);

var userData = {
     Username : 'ronakpatel@gmail.com',
     Pool : userPool
};

var cognitoUser = new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData);

cognitoUser.confirmRegistration('123456', true,function(err, result) {
if (err) {
    alert(err);
    return;
}
console.log('call result: ' + result);
});

看来目前 AWS Cognito 不能完美地处理客户端机密。它会在不久的将来运行,但目前它仍然是测试版。

对我来说,它在没有客户端密码的应用程序中工作正常,但在有客户端密码的应用程序中失败。

所以在您的用户池中尝试创建一个新的应用程序而不生成客户端密码。然后使用该应用注册新用户或确认注册。

这是我用来生成秘密哈希的示例php代码

<?php
    $userId = "aaa";
    $clientId = "bbb";
    $clientSecret = "ccc";
    $s = hash_hmac('sha256', $userId.$clientId, $clientSecret, true);
    echo base64_encode($s);
?>

在这种情况下,结果是:

DdSuILDJ2V84zfOChcn6TfgmlfnHsUYq0J6c01QV43I=

对于任何有兴趣使用 AWS Lambda 注册使用 AWS JS SDK 的用户,这些是我执行的步骤:

在python中创建另一个lambda函数来生成密钥:

import hashlib
import hmac
import base64

secretKey = "key"
clientId = "clientid"
digest = hmac.new(secretKey,
                  msg=username + clientId,
                  digestmod=hashlib.sha256
                 ).digest()
signature = base64.b64encode(digest).decode()

通过AWS中的nodeJS函数调用函数。签名充当 Cognito

的秘密哈希

注意:答案主要基于以下 link 中 George Campbell 的回答:Calculating a SHA hash with a string + secret key in python

根据文档:http://docs.aws.amazon.com/cognito/latest/developerguide/setting-up-the-javascript-sdk.html

Javascript SDK 不支持具有客户端密钥的应用程序。

现在的说明指出,您需要在为用户池创建应用程序时取消选中 "Generate Client Secret"。

在 Java 中,您可以使用此代码:

private String getSecretHash(String email, String appClientId, String appSecretKey) throws Exception {
    byte[] data = (email + appClientId).getBytes("UTF-8");
    byte[] key = appSecretKey.getBytes("UTF-8");

    return Base64.encodeAsString(HmacSHA256(data, key));
}

static byte[] HmacSHA256(byte[] data, byte[] key) throws Exception {
    String algorithm = "HmacSHA256";
    Mac mac = Mac.getInstance(algorithm);
    mac.init(new SecretKeySpec(key, algorithm));
    return mac.doFinal(data);
}

我在 .net SDK 中遇到了同样的问题。

以下是我的解决方法,以防其他人需要它:

public static class CognitoHashCalculator
{
    public static string GetSecretHash(string username, string appClientId, string appSecretKey)
    {
        var dataString = username + appClientId;

        var data = Encoding.UTF8.GetBytes(dataString);
        var key = Encoding.UTF8.GetBytes(appSecretKey);

        return Convert.ToBase64String(HmacSHA256(data, key));
    }

    public static byte[] HmacSHA256(byte[] data, byte[] key)
    {
        using (var shaAlgorithm = new System.Security.Cryptography.HMACSHA256(key))
        {
            var result = shaAlgorithm.ComputeHash(data);
            return result;
        }
    }
}

注册然后看起来像这样:

public class CognitoSignUpController
{
    private readonly IAmazonCognitoIdentityProvider _amazonCognitoIdentityProvider;

    public CognitoSignUpController(IAmazonCognitoIdentityProvider amazonCognitoIdentityProvider)
    {
        _amazonCognitoIdentityProvider = amazonCognitoIdentityProvider;
    }

    public async Task<bool> SignUpAsync(string userName, string password, string email)
    {
        try
        {
            var request = CreateSignUpRequest(userName, password, email);
            var authResp = await _amazonCognitoIdentityProvider.SignUpAsync(request);

            return true;
        }
        catch
        {
            return false;
        }
    }

    private static SignUpRequest CreateSignUpRequest(string userName, string password, string email)
    {
        var clientId = ConfigurationManager.AppSettings["ClientId"];
        var clientSecretId = ConfigurationManager.AppSettings["ClientSecretId"];

        var request = new SignUpRequest
        {
            ClientId = clientId,
            SecretHash = CognitoHashCalculator.GetSecretHash(userName, clientId, clientSecretId),
            Username = userName,
            Password = password,
        };

        request.UserAttributes.Add("email", email);
        return request;
    }
}

既然其他人都发布了他们的语言,这里是节点(它在浏览器中使用 browserify-crypto,如果你使用 webpack 或 browserify 会自动使用):

const crypto = require('crypto');

...

crypto.createHmac('SHA256', clientSecret)
  .update(username + clientId)
  .digest('base64')

golang 的解决方案。看来这应该添加到 SDK 中。

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
)

func SecretHash(username, clientID, clientSecret string) string {
    mac := hmac.New(sha256.New, []byte(clientSecret))
    mac.Write([]byte(username + ClientID))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

带有 Qt 框架的 C++

QByteArray MyObject::secretHash(
     const QByteArray& email,
     const QByteArray& appClientId, 
     const QByteArray& appSecretKey)
{
            QMessageAuthenticationCode code(QCryptographicHash::Sha256);
            code.setKey(appSecretKey);
            code.addData(email);
            code.addData(appClientId);
            return code.result().toBase64();
};

对于 JAVA 和 .NET,您需要在身份验证参数中传递具有名称 SECRET_HASH.

的秘密
AdminInitiateAuthRequest request = new AdminInitiateAuthRequest
{
  ClientId = this.authorizationSettings.AppClientId,
  AuthFlow = AuthFlowType.ADMIN_NO_SRP_AUTH,
  AuthParameters = new Dictionary<string, string>
  {
    {"USERNAME", username},
    {"PASSWORD", password},
    {
      "SECRET_HASH", EncryptionHelper.GetSecretHash(username, AppClientId, AppClientSecret)
    }
  },
  UserPoolId = this.authorizationSettings.UserPoolId
};

它应该可以工作。

使用 SecretHash 的 NodeJS 解决方案

AWS 从 SDK 中删除密钥似乎很愚蠢,因为它不会在 NodeJS 中公开。

我通过拦截获取并使用 的答案添加散列密钥,使其在 NodeJS 中工作。

cognito.js

import { CognitoUserPool, CognitoUserAttribute, CognitoUser } from 'amazon-cognito-identity-js'
import crypto from 'crypto'
import * as fetchIntercept from './fetch-intercept'

const COGNITO_SECRET_HASH_API = [
  'AWSCognitoIdentityProviderService.ConfirmForgotPassword',
  'AWSCognitoIdentityProviderService.ConfirmSignUp',
  'AWSCognitoIdentityProviderService.ForgotPassword',
  'AWSCognitoIdentityProviderService.ResendConfirmationCode',
  'AWSCognitoIdentityProviderService.SignUp',
]

const CLIENT_ID = 'xxx'
const CLIENT_SECRET = 'xxx'
const USER_POOL_ID = 'xxx'

const hashSecret = (clientSecret, username, clientId) => crypto.createHmac('SHA256', clientSecret)
  .update(username + clientId)
  .digest('base64')

fetchIntercept.register({
  request(url, config) {
    const { headers } = config
    if (headers && COGNITO_SECRET_HASH_API.includes(headers['X-Amz-Target'])) {
      const body = JSON.parse(config.body)
      const { ClientId: clientId, Username: username } = body
      // eslint-disable-next-line no-param-reassign
      config.body = JSON.stringify({
        ...body,
        SecretHash: hashSecret(CLIENT_SECRET, username, clientId),
      })
    }
    return [url, config]
  },
})

const userPool = new CognitoUserPool({
  UserPoolId: USER_POOL_ID,
  ClientId: CLIENT_ID,
})

const register = ({ email, password, mobileNumber }) => {
  const dataEmail = { Name: 'email', Value: email }
  const dataPhoneNumber = { Name: 'phone_number', Value: mobileNumber }

  const attributeList = [
    new CognitoUserAttribute(dataEmail),
    new CognitoUserAttribute(dataPhoneNumber),
  ]

  return userPool.signUp(email, password, attributeList, null, (err, result) => {
    if (err) {
      console.log((err.message || JSON.stringify(err)))
      return
    }
    const cognitoUser = result.user
    console.log(`user name is ${cognitoUser.getUsername()}`)
  })
}

export {
  register,
}

fetch-inceptor.js(从 https://github.com/werk85/fetch-intercept/blob/develop/src/index.js 的 Fork 中为 NodeJS 分叉和编辑)

let interceptors = []

if (!global.fetch) {
  try {
    // eslint-disable-next-line global-require
    global.fetch = require('node-fetch')
  } catch (err) {
    throw Error('No fetch available. Unable to register fetch-intercept')
  }
}
global.fetch = (function (fetch) {
  return (...args) => interceptor(fetch, ...args)
}(global.fetch))

const interceptor = (fetch, ...args) => {
  const reversedInterceptors = interceptors.reduce((array, _interceptor) => [_interceptor].concat(array), [])
  let promise = Promise.resolve(args)

  // Register request interceptors
  reversedInterceptors.forEach(({ request, requestError }) => {
    if (request || requestError) {
      promise = promise.then(_args => request(..._args), requestError)
    }
  })

  // Register fetch call
  promise = promise.then(_args => fetch(..._args))

  // Register response interceptors
  reversedInterceptors.forEach(({ response, responseError }) => {
    if (response || responseError) {
      promise = promise.then(response, responseError)
    }
  })

  return promise
}

const register = (_interceptor) => {
  interceptors.push(_interceptor)
  return () => {
    const index = interceptors.indexOf(_interceptor)
    if (index >= 0) {
      interceptors.splice(index, 1)
    }
  }
}

const clear = () => {
  interceptors = []
}

export {
  register,
  clear,
}

这可能晚了几年,但只需取消选中 "Generate client secret" 选项”,它就可以为您的 Web 客户端工作。

可能有更紧凑的版本,但这适用于 Ruby,特别是在 Ruby 和 Rails 中,无需任何要求:

key = ENV['COGNITO_SECRET_HASH']
data = username + ENV['COGNITO_CLIENT_ID']
digest = OpenSSL::Digest.new('sha256')

hmac = Base64.strict_encode64(OpenSSL::HMAC.digest(digest, key, data))

Amazon mention how Computing SecretHash Values for Amazon Cognito in their documentation with Java application code. Here this code works with boto 3 Python SDK.

您可以在 General settings 下的左侧菜单中找到您的 App clients。获取 App client idApp client secret 以创建 SECRET_HASH。为了您更好地理解,我注释掉了每一行的所有输出。

import hashlib
import hmac
import base64

app_client_secret = 'u8f323eb3itbr3731014d25spqtv5r6pu01olpp5tm8ebicb8qa'
app_client_id = '396u9ekukfo77nhcfbmqnrec8p'
username = 'wasdkiller'

# convert str to bytes
key = bytes(app_client_secret, 'latin-1')  # b'u8f323eb3itbr3731014d25spqtv5r6pu01olpp5tm8ebicb8qa'
msg = bytes(username + app_client_id, 'latin-1')  # b'wasdkiller396u9ekukfo77nhcfbmqnrec8p'

new_digest = hmac.new(key, msg, hashlib.sha256).digest()  # b'P$#\xd6\xc1\xc0U\xce\xc1$\x17\xa1=\x18L\xc5\x1b\xa4\xc8\xea,\x92\xf5\xb9\xcdM\xe4\x084\xf5\x03~'
SECRET_HASH = base64.b64encode(new_digest).decode()  # UCQj1sHAVc7BJBehPRhMxRukyOoskvW5zU3kCDT1A34=

boto 3文档中,我们可以看到很多时间询问SECRET_HASH。所以上面的代码行可以帮助你创建这个 SECRET_HASH.

如果您不想使用 SECRET_HASH,只需在创建应用程序时取消选中 Generate client secret

Cognito 身份验证

错误:应用程序客户端未配置秘密但已收到秘密哈希

提供 secretKey 为 nil 对我有用。提供的凭证包括:-

  • CognitoIdentityUserPoolRegion(区域)
  • CognitoIdentityUserPoolId (userPoolId)
  • CognitoIdentityUserPoolAppClientId (ClientId)
  • AWSCognitoUserPoolsSignInProviderKey (AccessKeyId)

    // setup service configuration
    let serviceConfiguration = AWSServiceConfiguration(region: CognitoIdentityUserPoolRegion, credentialsProvider: nil)
    
    // create pool configuration
    let poolConfiguration = AWSCognitoIdentityUserPoolConfiguration(clientId: CognitoIdentityUserPoolAppClientId,
                                                                    clientSecret: nil,
                                                                    poolId: CognitoIdentityUserPoolId)
    
    // initialize user pool client
    AWSCognitoIdentityUserPool.register(with: serviceConfiguration, userPoolConfiguration: poolConfiguration, forKey: AWSCognitoUserPoolsSignInProviderKey)
    

以上所有内容均适用于以下链接代码示例。

AWS 示例代码:https://github.com/awslabs/aws-sdk-ios-samples/tree/master/CognitoYourUserPools-Sample/Swift

如果这对您不起作用,请告诉我。

这是我的第一个命令,它有效(已确认:))

EMAIL="EMAIL@HERE.com" \
CLIENT_ID="[CLIENT_ID]" \
CLIENT_SECRET="[CLIENT_ID]" \
&& SECRET_HASH=$(echo -n "${EMAIL}${CLIENT_ID}" | openssl dgst -sha256 -hmac "${CLIENT_SECRET}" | xxd -r -p | openssl base64) \
&& aws cognito-idp ...  --secret-hash "${SECRET_HASH}"

此解决方案在 2021 年 3 月有效:

如果您正在使用同时生成“client_secret”和“client_id”的客户端,而不是计算 SECRET_HASH 并将其提供给函数在AWS docs中指定,传递“client_secret”.

注意:我试图从刷新令牌生成新令牌。

let result = await cognitoIdentityServiceProvidor
  .initiateAuth({
    AuthFlow: "REFRESH_TOKEN",
    ClientId: clientId,
    AuthParameters: {
      REFRESH_TOKEN: refresh_token,
      SECRET_HASH: clientSecret,
    },
  })
  .promise();

这很荒谬,但确实有效!

上述问题陈述的快速解决方法是删除现有的“App Client”并创建一个未选中 Generate client secret

的新客户端

注意:不要忘记更改代码中的应用程序客户端字符串。

以下内容现在似乎可以与 .NET 一起使用,asp.net 页面使用 Time Heur 的 Alexa Skills SDK for .NET

注入依赖

        private readonly CognitoUserManager<CognitoUser> _userManager;
 public RegisterModel(
            UserManager<CognitoUser> userManager,
            )
 _userManager = userManager as CognitoUserManager<CognitoUser> as CognitoUserManager<CognitoUser>;

然后分配一个散列

     var user = _pool.GetUser(Input.UserName);
_userManager.PasswordHasher.HashPassword(user,Input.Password);
 var result = await _userManager.CreateAsync(user, Input.Password);

NodeJS 解决方案:

  • 计算用于身份验证操作的秘密哈希值:

    import * as crypto from 'crypto';
    
    const secretHash = crypto
        .createHmac('SHA256', clientSecret)
        .update(email + clientId)
        .digest('base64');
    
  • 计算刷新令牌操作的秘密哈希值:

    import * as crypto from 'crypto';
    
    const secretHash = crypto
        .createHmac('SHA256', clientSecret)
        .update(sub + clientId)
        .digest('base64');
    

参数对象如下所示:

  const authenticateParams = {
    ClientId: clientId,
    UserPoolId: poolId,
    AuthFlow: CognitoAuthFlow.ADMIN_NO_SRP_AUTH,
    AuthParameters: {
      PASSWORD: password,
      USERNAME: email,
      SECRET_HASH: secretHash,
    },
  };

  const refreshTokenParams = {
    ClientId: clientId,
    UserPoolId: poolId,
    AuthFlow: CognitoAuthFlow.REFRESH_TOKEN_AUTH,
    AuthParameters: {
      REFRESH_TOKEN: refreshToken,
      SECRET_HASH: secretHash,
    },
  };

用法:

import * as CognitoIdentityProvider from 'aws-sdk/clients/cognitoidentityserviceprovider';

const provider = new CognitoIdentityProvider({ region });
provider.adminInitiateAuth(params).promise(); // authenticateParams or refreshTokenParams, return a promise object.

javascript 的 crypto 包已弃用,因此使用 crypto-js:

import CryptoJS from 'crypto-js';
import Base64 from 'crypto-js/enc-base64';

const secretHash = Base64.stringify(CryptoJS.HmacSHA256(username + clientId, clientSecret));

Remeber to run npm install @types/crypto-js crypto-js before