在Cognito中使用Spring Security获取自定义属性

，可以通过以下步骤实现：

首先，确保已经在Cognito用户池中创建了自定义属性。可以在Cognito控制台的“用户池设置”中进行配置。例如，可以创建一个名为“customAttribute”的自定义属性。
在Spring Boot项目中，添加Spring Security和AWS SDK的依赖。可以在项目的pom.xml文件中添加以下依赖：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>cognitoidentityprovider</artifactId>
</dependency>

创建一个自定义的CognitoUserService类，实现UserDetailsService接口。这个类将用于从Cognito中获取用户信息。

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import software.amazon.awssdk.services.cognitoidentityprovider.CognitoIdentityProviderClient;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AdminGetUserRequest;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AdminGetUserResponse;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AttributeType;

@Service
public class CognitoUserService implements UserDetailsService {

    @Autowired
    private CognitoIdentityProviderClient cognitoClient;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        AdminGetUserRequest request = AdminGetUserRequest.builder()
                .userPoolId("your-user-pool-id")
                .username(username)
                .build();

        AdminGetUserResponse response = cognitoClient.adminGetUser(request);

        // 获取自定义属性
        List<AttributeType> attributes = response.userAttributes();
        for (AttributeType attribute : attributes) {
            if (attribute.name().equals("customAttribute")) {
                // 在这里可以获取自定义属性的值，并进行相应的处理
                String customAttributeValue = attribute.value();
                // ...
            }
        }

        // 返回UserDetails对象，可以根据需要进行自定义
        return new CustomUserDetails(response.username(), response.enabled(), response.userStatus());
    }
}

在Spring Security配置类中，将自定义的CognitoUserService注册为UserDetailsService。

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/user/**").hasRole("USER")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout().logoutSuccessUrl("/");
    }
}

在控制器中，可以通过注入Authentication对象来获取用户的自定义属性。

import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class UserController {

    @GetMapping("/user/profile")
    public String getUserProfile(Authentication authentication) {
        // 获取自定义属性
        String customAttributeValue = authentication.getPrincipal().getCustomAttributeValue();
        // ...

        return "User Profile";
    }
}

这样，就可以在Cognito中使用Spring Security获取自定义属性了。在Cognito用户池中创建自定义属性后，通过CognitoUserService类从Cognito中获取用户信息，并在控制器中使用Authentication对象获取自定义属性。根据实际需求，可以进一步处理自定义属性的值。