验证服务器返回cognito_identityId和cognito_token.

然后我设置了一个Cookie：

> $.cookie(‘cognito_identityId’)
> $.cookie(‘cognito_token’)

我尝试在浏览器上以4种方式获取凭据,并且所有失败：

> CognitoIdentityCredentials

AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: 'us-east-1:xxxxxxxxxxxx'
    IdentityId: $.cookie('cognito_identityId'),Logins: {
        'myauth': $.cookie('cognito_token')
    }
});

// =>错误：在参数中缺少必需的键’IdentityId’
> assumeRoleWithWebIdentity

var params = {
  RoleArn: 'arn:aws:iam::xxxxxxxxxxxx:role/Cognito_xxxxxxxAuth_Role',RoleSessionName: 'xxxxxxxxxxx',WebIdentityToken: $.cookie('cognito_token'),DurationSeconds: 900,ProviderId: 'myauth'
};
var sts = new AWS.STS({apiVersion: '2011-06-15'});
sts.assumeRoleWithWebIdentity(params,function(err,data) {
  if (err) console.log(err,err.stack); // an error occurred
  else     console.log(data);           // successful response
});

// => AccessDenied：未授权执行sts：AssumeRoleWithWebIdentity

PolicyDocument

{
"Version": "2012-10-17","Statement": [
  {
    "Sid": "","Effect": "Allow","Principal": {
      "Federated": "cognito-identity.amazonaws.com"
    },"Action": "sts:AssumeRoleWithWebIdentity","Condition": {
      "StringEquals": {
        "cognito-identity.amazonaws.com:aud": "us-east-1:xxxxxxxxxxxxx"
      },"ForAnyValue:StringLike": {
        "cognito-identity.amazonaws.com:amr": "authenticated"
      }
    }
  }
]
}

> GetCredentialsForIdentity

var params = {
    IdentityId: $.cookie('cognito_identityId'),Logins: {
      "myauth": $.cookie('oauth.io_token')
    }
};
var cognitoidentity = new AWS.CognitoIdentity({apiVersion: '2014-06-30'});
cognitoidentity.getCredentialsForIdentity(params,data) {
  if (err) {
    console.log(err,err.stack); // an error occurred
  }
  else {
    console.log(data);           // successful response
  }
});

// => InvalidParameterException：请提供有效的公共提供者
> WebIdentityCredentials

AWS.config.credentials = new AWS.WebIdentityCredentials({
    RoleArn: 'arn:aws:iam::xxxxxxxx:role/Cognito_xxxxxxxxxxAuth_Role',WebIdentityToken: $.cookie('cognito_token')
});

// =>错误：有2个验证错误：
// * MissingrequiredParameter：在params中缺少必需的键’IdentityPoolId’
// * MissingrequiredParameter：在params中缺少必需的键’IdentityId’

问题：

>我做错了什么？
>使用它的正确方法是什么？

谢谢.

谢谢你的好意.

我提出了你的建议,但没有改变.

错误消息.

POST https://cognito-identity.us-east-1.amazonaws.com/ 400 (Bad Request)
POST https://cognito-identity.us-east-1.amazonaws.com/ 400 (Bad Request)
Error: Missing required key 'IdentityId' in params
    at fail (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:2163:37)
    at validateStructure (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:2084:14)
    at validateMember (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:2110:21)
    at validate (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:2059:10)
    at Request.VALIDATE_PARAMETERS (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:800:32)
    at Request.callListeners (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:3913:20)
    at callNextListener (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:3903:12)
    at chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:787:9
    at finish (chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:126:7)
    at chrome-extension://hmjdjbikinkmjbilihjibcihbkbjdgjf/bower_components/aws-sdk-js/dist/aws-sdk.js:142:9

链接下面有源代码.

https://github.com/bisque33/my-custom-dictionary

和服务器端是AWS Lambda函数.

var aws = require('aws-sdk');
aws.config.region = 'us-east-1';
var cognitoidentity = new aws.CognitoIdentity();
var identityPoolId = 'us-east-1:0dccff0d-5fd7-4d14-b38f-d27204feaecc';

console.log('Loading function');

exports.handler = function(event,context) {
    console.log('token: %s',event.token);

    var params = {
        IdentityPoolId: identityPoolId,Logins: {
            'oauth.io': event.token
        }
    };
    cognitoidentity.getOpenIdTokenForDeveloperIdentity(params,data){
        if(err){
            console.log(err);
            context.fail('Something went wrong');
        }else{
            context.succeed(data);
        }
    });
};

此程序是Google-Chrome-Extension.

> AWS Lambda函数通过getOpenIdTokenForDeveloperIdentity返回标记.
> app / scripts / popup.js调用Lambda函数并设置cookie.
> app / scripts / background.js调用AWS.config.credentials.get,并返回错误.

我用错了吗？

更新附加信息

感谢您提供更多信息.

错误出现在background.js上的104行

AWS.config.credentials.get(function(){

和background.js上的115行

dataset.synchronize(

而且,我的解释还不够. Facebook身份验证需要域名(例如http：// example.com).但是,Google-Chrome-Ext没有域名.它有一个域’chrome-extension：// xxxxxxxxxxxxxxxxxxxx’.然后,我使用https://oauth.io.它代理任何身份验证并接受chrome-extension域.

Popup.js通过oauth.io sdk进行Facebook身份验证.它获取了一个facebook令牌,并提供给getOpenIdTokenForDeveloperIdentity.我认为facebook token.substr(0,14)是独一无二的.但是,如果它是错的,我使用另一个唯一标识符(例如电子邮件地址.)

对不起我错了. AWS.config.credentials.get给出错误：

Error: Invalid login token.

并且,dataset.synchronize显示此错误：

Error: Missing required key 'IdentityId' in params