blocks|key|23940|text|我在理解您的用例时遇到了一些问题，但我将解释一些可能会有所帮助的要点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|23941|您可以使用Cognito用户池通过Google对用户进行身份验证，然后从Cognito用户池发出JWT令牌。请参阅Developer+Guide。|offset|length|23942|Cognito+User+Pools目前还不是一个完整的OpenID身份提供者，但它在我们的路线图上。用户池确实支持OAuth2.0流，并且它们确实提供OpenID标准JWT令牌。|23943|entityMap|0|LINK|mutability|MUTABLE|url|http://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html^0|0|1L|F|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

<p>I'm having a little trouble following your use case, but I'll explain some points that might help.</p>

<p>You can use Cognito User Pools to authenticate users through Google, and then issue JWT tokens from the Cognito User Pool.  See the <a href="http://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html" rel="nofollow noreferrer">Developer Guide</a>.</p>

<p>Cognito User Pools is not currently a full OpenID identity provider, but that is on our roadmap. User Pools do support OAuth2.0 flows, and they do provide OpenID standard JWT tokens. </p>


blocks|key|23945|text|Cognito确实提供了OpenId连接端点，正如@Badri在本blog+post中详细介绍的那样|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|23946|授权的公式是：|23947|https://cognito-idp.{region}.amazonaws.com/{userPoolId}|code-block|syntax|javascript|23948|您可以通过检查元数据URL来验证其中是否存在某些内容|23949|https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/openid-configuration|23950|然后，在客户端池设置期间，您可以与其他OIDC提供程序联合，还可以在应用程序客户端设置中启用OIDC提供程序。这将使您的场景听起来非常类似于我想要做的事情。然而，这篇博客文章遗漏了一个关键的配置，那就是为应用程序集成设置域名。如果您不配置此域并在答案中链接到解决方案，This+StackOverflow+question将显示您将收到的错误。一旦我设置了域名，Badri的代码就为我工作了。|23951|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/1709870/badri|1|https://lbadri.wordpress.com/2018/02/25/asp-net-core-2-0-oidc-authentication-using-aws-cognito/|2|https://stackoverflow.com/q/50569395/36737^0|P|6|0|X|9|1|0|0|0|0|0|3Q|R|2|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]|$A|16|B|17|1|18]]|C|$]]|$1|D|3|E|5|6|7|19|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1A|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|1B|8|@]|9|@]|C|$]]|$1|M|3|N|5|H|7|1C|8|@]|9|@]|C|$I|J]]|$1|O|3|P|5|6|7|1D|8|@]|9|@$A|1E|B|1F|1|1G]]|C|$]]|$1|Q|3|-4|5|6|7|1H|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]|Y|$5|T|U|V|C|$W|Z]]|10|$5|T|U|V|C|$W|11]]]]

<p>Cognito does provide an OpenId connect endpoint, as detailed in this <a href="https://lbadri.wordpress.com/2018/02/25/asp-net-core-2-0-oidc-authentication-using-aws-cognito/" rel="noreferrer">blog post</a> by <a href="https://stackoverflow.com/users/1709870/badri">@Badri</a></p>

<p>The formula for the authority is:</p>

<pre><code>https://cognito-idp.{region}.amazonaws.com/{userPoolId}
</code></pre>

<p>And you can verify by checking the metadata URL that something is there</p>

<pre><code>https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/openid-configuration
</code></pre>

<p>Then during client pool setup, you can federate with other OIDC providers, and also enable the OIDC provider in the app client settings.  Which should enable your scenario which sounds very similar to what I would like to do.  However, the blog post misses one crucial piece of configuration, which is setting a domain name for the app integration.  <a href="https://stackoverflow.com/q/50569395/36737">This StackOverflow question</a> shows the error you will receive if you do not configure this domain and links to the solution in an answer.  Once I set the domain, Badri's code worked for me.</p>


blocks|key|23898|text|提供关于Cognito的OpenID连接支持的更详细的答案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|23899|发现端点|23900|Cognito在以下位置公开了一个OpenID连接发现端点，如https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest所述：|offset|length|23901|https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/openid-configuration|code-block|syntax|javascript|23902|响应类型|23903|上述端点返回以下三个response_types：|23904|"response_types_supported":["code","token","token+id_token"]|23905|23906|代码:在https://www.rfc-editor.org/rfc/rfc6749#section-11.3.2中定义-这对我们有效，但仅当如下所示指定了域时才有效。|unordered-list-item|23907|23908|23909|令牌：https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest上的OpenID连接禁止使用此值-“注意:虽然OAuth+2.0还为隐式流定义了令牌响应类型值，但OpenID连接不使用此响应类型，因为不会返回ID令牌。”-+OpenID连接库将忽略此响应。|23910|23911|23912|token+id_token:该值触发重定向到错误页面，代码为"invalid_request“。对于请求的无效之处，没有给出任何指示。亚马逊网络服务技术支持声称，授权端点只支持“response_type”和"token“，但是，如果不支持，则不清楚为什么要通告此代码。|23913|23914|域名|23915|Cognito提供了指定域的选项，该域将作为Cognito端点的主机名的前缀。|23916|在未指定域的情况下，Cognito将在OpenID连接发现端点(如https://cognito-idp.eu-west-2.amazonaws.com/{userPoolId}/authorize+)通告通用URL，但所有尝试登录这些URL都会返回错误消息：|23917|{"code":"BadRequest","message":"The+server+did+not+understand+the+operation+that+was+requested.","type":"client"}|23918|错误消息并没有指出请求的错误所在，因此这似乎是Cognito中的一个bug。|23919|指定了域之后，Cognito将通告包含域前缀的URL，代码“response_type”会如期返回登录页面。|23920|注销|23921|https://openid.net/specs/openid-connect-session-1_0.html#RPLogout的OpenID连接会话管理介绍了如何启动OpenID连接注销，并根据https://openid.net/specs/openid-connect-session-1_0.html#OPMetadata要求在发现元数据中包含end_session_endpoint参数。|23922|在Cognito的情况下，元数据中省略了end_session_endpoint。|23923|RP-Initiated+Logout+at+https://openid.net/specs/openid-connect-session-1_0.html#RPLogout描述注销端点的工作方式。如果尝试手动将注销端点传递到OpenID连接客户端实现，则注销失败，如下所示：|23924|{"code":"BadRequest","message":"The+server+did+not+understand+the+operation+that+was+requested.","type":"client"}|23925|同样，错误消息没有给出错误的指示，但是https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html上的注销端点的描述显示与OpenID连接不兼容。|23926|虽然您可以使用登录到OpenID，但是没有注销的选项。|23927|云表单|23928|Cognito+Cloudformation支持不完整，会影响OpenID连接，如下所示：|23929|23930|无法使用CloudFormation指定域，而该域是OpenID连接工作所必需的。|23931|+OpenID连接需要回调URL，但无法使用Cloudformation设置回调URL|23932|23933|摘要|23934|要使用Cognito访问OpenID，请确保指定了一个域，并仅使用response_type“代码”。无法注销OpenID连接。其他选项违反了OpenID连接规范，或被破坏发布。|23935|entityMap|0|LINK|mutability|MUTABLE|url|https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest|1|https://www.rfc-editor.org/rfc/rfc6749#section-11.3.2|2|https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest|3|https://cognito-idp.eu-west-2.amazonaws.com/%257BuserPoolId%257D/authorize|4|https://openid.net/specs/openid-connect-session-1_0.html#RPLogout|5|https://openid.net/specs/openid-connect-session-1_0.html#OPMetadata|6|7|https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html^0|0|0|V|2F|0|0|0|0|0|0|0|4|1H|1|0|0|0|3|21|2|0|0|0|0|0|0|0|X|1U|3|0|0|0|0|0|0|1T|4|2R|1V|5|0|0|N|1T|6|0|0|J|26|7|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|2U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|2V|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|2W|8|@]|9|@$F|2X|G|2Y|1|2Z]]|A|$]]|$1|H|3|I|5|J|7|30|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|31|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|32|8|@]|9|@]|A|$]]|$1|Q|3|R|5|J|7|33|8|@]|9|@]|A|$K|L]]|$1|S|3|-4|5|6|7|34|8|@]|9|@]|A|$]]|$1|T|3|U|5|V|7|35|8|@]|9|@$F|36|G|37|1|38]]|A|$]]|$1|W|3|-4|5|6|7|39|8|@]|9|@]|A|$]]|$1|X|3|-4|5|6|7|3A|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|V|7|3B|8|@]|9|@$F|3C|G|3D|1|3E]]|A|$]]|$1|10|3|-4|5|6|7|3F|8|@]|9|@]|A|$]]|$1|11|3|-4|5|6|7|3G|8|@]|9|@]|A|$]]|$1|12|3|13|5|V|7|3H|8|@]|9|@]|A|$]]|$1|14|3|-4|5|6|7|3I|8|@]|9|@]|A|$]]|$1|15|3|16|5|6|7|3J|8|@]|9|@]|A|$]]|$1|17|3|18|5|6|7|3K|8|@]|9|@]|A|$]]|$1|19|3|1A|5|6|7|3L|8|@]|9|@$F|3M|G|3N|1|3O]]|A|$]]|$1|1B|3|1C|5|J|7|3P|8|@]|9|@]|A|$K|L]]|$1|1D|3|1E|5|6|7|3Q|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|6|7|3R|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|6|7|3S|8|@]|9|@]|A|$]]|$1|1J|3|1K|5|6|7|3T|8|@]|9|@$F|3U|G|3V|1|3W]|$F|3X|G|3Y|1|3Z]]|A|$]]|$1|1L|3|1M|5|6|7|40|8|@]|9|@]|A|$]]|$1|1N|3|1O|5|6|7|41|8|@]|9|@$F|42|G|43|1|44]]|A|$]]|$1|1P|3|1Q|5|J|7|45|8|@]|9|@]|A|$K|L]]|$1|1R|3|1S|5|6|7|46|8|@]|9|@$F|47|G|48|1|49]]|A|$]]|$1|1T|3|1U|5|6|7|4A|8|@]|9|@]|A|$]]|$1|1V|3|1W|5|6|7|4B|8|@]|9|@]|A|$]]|$1|1X|3|1Y|5|6|7|4C|8|@]|9|@]|A|$]]|$1|1Z|3|-4|5|6|7|4D|8|@]|9|@]|A|$]]|$1|20|3|21|5|V|7|4E|8|@]|9|@]|A|$]]|$1|22|3|23|5|V|7|4F|8|@]|9|@]|A|$]]|$1|24|3|-4|5|6|7|4G|8|@]|9|@]|A|$]]|$1|25|3|26|5|6|7|4H|8|@]|9|@]|A|$]]|$1|27|3|28|5|6|7|4I|8|@]|9|@]|A|$]]|$1|29|3|-4|5|6|7|4J|8|@]|9|@]|A|$]]]|2A|$2B|$5|2C|2D|2E|A|$2F|2G]]|2H|$5|2C|2D|2E|A|$2F|2I]]|2J|$5|2C|2D|2E|A|$2F|2K]]|2L|$5|2C|2D|2E|A|$2F|2M]]|2N|$5|2C|2D|2E|A|$2F|2O]]|2P|$5|2C|2D|2E|A|$2F|2Q]]|2R|$5|2C|2D|2E|A|$2F|2O]]|2S|$5|2C|2D|2E|A|$2F|2T]]]]

<p>To give a more detailed answer on Cognito's OpenID Connect support.</p>
<h2>Discovery Endpoint</h2>
<p>Cognito exposes an OpenID Connect Discovery endpoint as described at <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest" rel="nofollow noreferrer">https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest</a> at the following location:</p>
<pre><code>https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/openid-configuration
</code></pre>
<h2>Response Types</h2>
<p>The above endpoint returns the following three response_types:</p>
<pre><code>&quot;response_types_supported&quot;:[&quot;code&quot;,&quot;token&quot;,&quot;token id_token&quot;]
</code></pre>
<ul>
<li><p>code: defined in <a href="https://www.rfc-editor.org/rfc/rfc6749#section-11.3.2" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc6749#section-11.3.2</a> - this worked for us, but only when a domain was specified as below.</p>
</li>
<li><p>token: this value is forbidden by OpenID Connect at <a href="https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest" rel="nofollow noreferrer">https://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthRequest</a> - <em>&quot;NOTE: While OAuth 2.0 also defines the token Response Type value for the Implicit Flow, OpenID Connect does not use this Response Type, since no ID Token would be returned.&quot;</em> - OpenID Connect libraries will ignore this response.</p>
</li>
<li><p>token id_token: this value triggers a redirect to an error page with the code &quot;invalid_request&quot;. There is no indication given as to what is invalid with the request. AWS technical support claim that only &quot;code&quot; and &quot;token&quot; are supported by authorize endpoint, it is however not clear why this response_type is advertised if not supported.</p>
</li>
</ul>
<h2>Domain</h2>
<p>Cognito gives the option to specify a domain that will prefix the hostname of the Cognito endpoint.</p>
<p>Without a domain being specified, Cognito will advertise generic URLs at the OpenID Connect discovery endpoint such as <a href="https://cognito-idp.eu-west-2.amazonaws.com/%7BuserPoolId%7D/authorize" rel="nofollow noreferrer">https://cognito-idp.eu-west-2.amazonaws.com/{userPoolId}/authorize</a>, but all attempts to log in at these URLs return the error message:</p>
<pre><code>{&quot;code&quot;:&quot;BadRequest&quot;,&quot;message&quot;:&quot;The server did not understand the operation that was requested.&quot;,&quot;type&quot;:&quot;client&quot;}
</code></pre>
<p>The error message does not indicate what is bad about the request, so this appears to be a bug in Cognito.</p>
<p>With a domain specified, Cognito will advertise URLs that include the domain prefix, and the response_type &quot;code&quot; returns a login page as expected.</p>
<h2>Logout</h2>
<p>OpenID Connect Session Management at <a href="https://openid.net/specs/openid-connect-session-1_0.html#RPLogout" rel="nofollow noreferrer">https://openid.net/specs/openid-connect-session-1_0.html#RPLogout</a> describes how an OpenID Connect logout must be initiated, and requires as per <a href="https://openid.net/specs/openid-connect-session-1_0.html#OPMetadata" rel="nofollow noreferrer">https://openid.net/specs/openid-connect-session-1_0.html#OPMetadata</a> that the end_session_endpoint parameter be included in the discovery metadata.</p>
<p>In the case of Cognito end_session_endpoint is omitted from the metadata.</p>
<p>RP-Initiated Logout at <a href="https://openid.net/specs/openid-connect-session-1_0.html#RPLogout" rel="nofollow noreferrer">https://openid.net/specs/openid-connect-session-1_0.html#RPLogout</a> describes how the logout endpoint works. If an attempt is made to pass the logout endpoint manually to the OpenID Connect client implementation, logout fails as follows:</p>
<pre><code>{&quot;code&quot;:&quot;BadRequest&quot;,&quot;message&quot;:&quot;The server did not understand the operation that was requested.&quot;,&quot;type&quot;:&quot;client&quot;}
</code></pre>
<p>Again, the error message gives no indication of the error, however the description of the logout endpoint at <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html</a> shows no compatibility with OpenID Connect.</p>
<p>While you can log into Cognito using OpenID Connect, there is no option to log out.</p>
<h2>Cloudformation</h2>
<p>Cognito Cloudformation support is incomplete, and affects OpenID Connect as follows:</p>
<ul>
<li>There is no way to specify a domain using Cloudformation, and the domain is required for OpenID Connect to work.</li>
<li>The callback URL is required by OpenID Connect, but cannot be set using Cloudformation.</li>
</ul>
<h2>Summary</h2>
<p>To access Cognito using OpenID Connect, ensure that a domain is specified, and use the response_type &quot;code&quot; only. OpenID Connect logout is not possible. Other options violate the OpenID Connect specification, or were released broken.</p>


<p>I want to use AWS cognito as a OpenId connect provider.My AWS cognito IDP will intern call my another OpenId provider to authenticate the user. It will then create its new token and hand over to callers as its own.</p>

<p>The OpenID provider used internally by AWS cognito pool is transparent to user. User only configures AWS cognito as its IDP provider.</p>

<p>User case</p>

<ul>
<li>User authenticates with My AWS IDP provider</li>
<li>My IDP provider authenticates the user agains Googles IDP provider</li>
<li>My IDP decodes the token returned by Google IDP.</li>
<li>My IDP Creates new token and add additional claims.</li>
<li>My IDP hands over my JWT to user.</li>
</ul>

<p>Question</p>

<ul>
<li>Is this possible in AWS cognito?</li>
<li>Does AWS user pool expose OpenID connect endpoint?</li>
</ul>


Can i use AWS cognito to provide a open id connect endpoint?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我想使用亚马逊网络服务认证作为一个OpenId连接provider.My亚马逊网络服务认证身份提供商将实习生呼叫我的另一个OpenId提供商来验证用户。然后，它将创建它的新令牌，并将其作为自己的令牌移交给调用者。亚马逊网络服务认知池内部使用的OpenID提供商对用户是透明的。用户仅将AWS cognito配置为其IDP...

问我能否使用AWS cognito来提供开放的id连接端点？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我能否使用AWS cognito来提供开放的id连接端点？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问我能否使用AWS cognito来提供开放的id连接端点？
EN