护照-google-auth + aws cognito + nodejs

Question

我正在使用 passport-google-auth 来验证 google 用户，它 returns 我 access_token 我正在使用它来获取 aws Cognito 凭证，但是它抛出一个错误：

NotAuthorizedException: Invalid login token. Not a valid OpenId Connect identity token.

我的代码片段：

passport.use(new GoogleStrategy(googleDeveloperDetails, getUserDetails));

app.get("/auth/google", passport.authenticate("google", { scope: ['email'] }));

var authGoogle = passport.authenticate("google", {
failureRedirect: "/auth/google"
});

  app.get("auth/google/callback", authGoogle, controller.successRedirect);

 getUserDetails = function(accessToken, refreshToken, params, profile, done) {        
    profile.token = accessToken;      
    done(null, profile);
}

googleDeveloperDetails = {
    clientID: "google cleint ID",
    clientSecret: "google client secret",
    callbackURL: "https://localhost:3000/auth/google/callback",
    profileFields: ["emails", "profile"]
}

Answer 1

已解决

通过使用从 Google 收到的 params.id_token 解决。 Google 护照 returns accessToken、refreshToken 和 params.id_token，在搜索和阅读 open-id-connect 个提供商后，我得到了解决方案。

解决方法如下：

passport.use(new GoogleStrategy(googleDeveloperDetails, getUserDetails));

app.get("/auth/google", passport.authenticate("google", { scope: ['email'] }));

var authGoogle = passport.authenticate("google", {
    failureRedirect: "/auth/google"
});

app.get("auth/google/callback", authGoogle, controller.successRedirect);

getUserDetails = function(accessToken, refreshToken, params, profile, done) {
  if(profile.provider == "google") {
        // params.id_token to be used to get cognito credentials
        profile.token = params.id_token;   
  } else {
        profile.token = accessToken;
  }
  done(null, profile);
}

googleDeveloperDetails = {
   clientID: "google cleint ID",
   clientSecret: "google client secret",
   callbackURL: "https://localhost:3000/auth/google/callback",
   profileFields: ["emails", "profile"]
}

护照-google-auth + aws cognito + nodejs

passport-google-auth + aws cognito + nodejs

node.js

passport.js

aws-cognito