amazon-archives / aws-serverless-auth-reference-app

Serverless reference app and backend API, showcasing authentication and authorization patterns using Amazon Cognito, Amazon API Gateway, AWS Lambda, and AWS IAM.
Other
754 stars 193 forks source link

How can i get my temporary credentials for my federated Id token ? #55

Closed Private-SO closed 5 years ago

Private-SO commented 5 years ago

Usecase : I want to limit access to my API gateway paths using federated identites.

For that i need to get AWS temporary credentials by using my ID token. I got my Id token but i donot know how to get temporary credentials using Id token.

Here is am passing ID token to cognito credentials map

 var data = {
          UserPoolId: config.cognito.USER_POOL_ID,
          ClientId: config.cognito.APP_CLIENT_ID,
        };
        var userPool = new AmazonCognitoIdentity.CognitoUserPool(data);
        var cognitoUser = userPool.getCurrentUser();
        if (cognitoUser != null) {
          cognitoUser.getSession(function(err, result) {
              if (result) {
                  console.log('You are now logged in.');

                  // Add the User's Id Token to the Cognito credentials login map.
                  AWS.config.credentials = new AWS.CognitoIdentityCredentials({
                      IdentityPoolId: config.cognito.IDENTITY_POOL_ID,
                      Logins: {
                        'cognito-idp.ap-south-1.amazonaws.com/ap-south-1_G7YbVxxxx': result.getIdToken().getJwtToken()
                      }
                  });
              }
          });
      }

How to get temporary credentials ?

BTW the credentials (ie.access key,secret access key etc) showed in REINVENT is temporary credentials ? If it is then where you had defined them in this app ?

Thanks

Private-SO commented 5 years ago

I got this using below snippet

AWS.config.credentials.get(function(err,data) {
      if (!err) {
        var id = AWS.config.credentials.identityId;
        var key = AWS.config.credentials.accessKeyId;
        var secretkey = AWS.config.credentials.secretAccessKey;
        var sessionToken = AWS.config.credentials.sessionToken;
        console.log('Cognito Identity ID '+ id);
        console.log('Cognito Key '+ key);
        console.log('Cognito Secret Key '+ secretkey);
        console.log('Cognito SessionToken '+ sessionToken);
      }
    });