2019年10月,UserPoolIdentityProvider
被添加到了官方文档中。
您的CloudFormation将类似于以下内容:
CognitoUserPoolIdentityProvider:
Type: AWS::Cognito::UserPoolIdentityProvider
Properties:
ProviderName: Google
AttributeMapping:
email: emailAddress
ProviderDetails:
client_id: <yourclientid>.apps.googleusercontent.com
client_secret: <yourclientsecret>
authorize_scopes: email openid
ProviderType: Google
UserPoolId:
Ref: CognitoUserPool
目前来看,Cloudformation 并不支持大量 Cognito 的细节,但在堆栈启动后有一些方法可以实现您想要的功能,例如使用 Lambdas。
请参见以下答案:
FacebookIdp:
Type: 'Custom::${self:service}-${self:provider.stage}-CUPIdentityProvider'
DependsOn:
- CFNSendResponseLambdaFunction
- CUPIdentityProviderLambdaFunction
Properties:
ServiceToken:
Fn::GetAtt: [CUPIdentityProviderLambdaFunction, Arn]
UserPoolId:
Ref: AppUserPool
ProviderName: Facebook
ProviderType: Facebook
Client_id: 'YourFacebookAppID'
Client_secret: 'YourFacebookAppSecert'
Authorize_scopes: 'public_profile,email'
AppUserPoolClientSettings:
Type: 'Custom::${self:service}-${self:provider.stage}-CUPClientSettings'
DependsOn:
- CFNSendResponseLambdaFunction
- CUPClientSettingsLambdaFunction
- FacebookIdp
Properties:
ServiceToken:
Fn::GetAtt: [ CUPClientSettingsLambdaFunction, Arn]
UserPoolId:
Ref: AppUserPool
UserPoolClientId:
Ref: AppUserPoolClient
SupportedIdentityProviders:
- COGNITO
- Facebook
CallbackURL: 'https://www.yourdomain.com/callback' ##Replace this with your app callback url
LogoutURL: 'https://www.yourdomain.com/logout' ##Replace this with your app logout url
AllowedOAuthFlowsUserPoolClient: true
AllowedOAuthFlows:
- code
AllowedOAuthScopes:
- openid
使用通用自定义资源提供程序, 您可以创建所有CFN不支持的资源。
这里给出的示例特别是为了创建和配置Google SAML身份验证的Cognito。
通过更改传递给自定义资源处理程序的参数,例如,将其更改为使用Google oAuth而不是SAML应该很容易。
UserPoolIdentityProvider:
Type: 'Custom::CognitoUserPoolIdentityProvider'
Condition: HasMetadata
DependsOn: UserPool
Properties:
ServiceToken: !Sub '${CustomResourceLambdaArn}'
AgentService: cognito-idp
AgentType: client
# https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cognito-idp.html#CognitoIdentityProvider.Client.create_user_pool_domain
AgentCreateMethod: create_identity_provider
AgentUpdateMethod: update_identity_provider
AgentDeleteMethod: delete_identity_provider
AgentResourceId: ProviderName
AgentCreateArgs:
UserPoolId: !Sub '${UserPool}'
ProviderName: google-provider
AttributeMapping:
email: emailAddress
ProviderDetails:
google_app_id: some_value
google_app_secret: some_value
google_authorize_scope: some_value
ProviderType: Google
AgentUpdateArgs:
UserPoolId: !Sub '${UserPool}'
ProviderName: google-provider
AttributeMapping:
email: emailAddress
ProviderDetails:
google_app_id: some_value
google_app_secret: some_value
google_authorize_scope: some_value
ProviderType: Google
AgentDeleteArgs:
UserPoolId: !Sub '${UserPool}'
ProviderName: google-provider
ProviderDetails
下参数的正确名称,即Google应用程序ID
、应用程序密钥
和授权范围
。另外,AttributeMapping
可能需要设置为其他内容。