{ "componentChunkName": "component---src-templates-tag-js", "path": "/tag/amazon-cognito/", "result": {"data":{"ghostTag":{"slug":"amazon-cognito","name":"Amazon Cognito","visibility":"public","feature_image":null,"description":null,"meta_title":null,"meta_description":null},"allGhostPost":{"edges":[{"node":{"id":"Ghost__Post__61040a413986b000013a45df","title":"GolangでCognito認証しトークンを取得する","slug":"golang-cognito","featured":false,"feature_image":null,"excerpt":"自分が関わっているサービスで、認証にAmazon Cognitoを使っています。\n\nAmazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWSAmazon Web Services, Inc.\n[https://aws.amazon.com/jp/cognito/]\n全てのリクエストについてトークンの検証をするので、APIサーバの動作確認時に必ずヘッダにトークンをセットする必要があります。このトークンを用意するのが地味に面倒だったので、Golangでスクリプトを書きました。\n\n以下の記事を参考にしました。\n\ngolangでCognito認証（ただしSecure Remote Password(SRP)プロトコルではない） - Qiita参考\nhttp://docs.aws.amazon.com/ja_jp/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.ht...\nQiitacobachan [https://qiita.com/cobachan/items/9e","custom_excerpt":null,"visibility":"public","created_at_pretty":"30 July, 2021","published_at_pretty":"29 June, 2021","updated_at_pretty":"23 August, 2021","created_at":"2021-07-30T23:18:41.000+09:00","published_at":"2021-06-30T00:00:00.000+09:00","updated_at":"2021-08-23T21:41:10.000+09:00","meta_title":null,"meta_description":null,"og_description":null,"og_image":null,"og_title":null,"twitter_description":null,"twitter_image":null,"twitter_title":null,"authors":[{"name":"Yu Takahashi","slug":"yu","bio":null,"profile_image":null,"twitter":null,"facebook":null,"website":null}],"primary_author":{"name":"Yu Takahashi","slug":"yu","bio":null,"profile_image":null,"twitter":null,"facebook":null,"website":null},"primary_tag":{"name":"Amazon Cognito","slug":"amazon-cognito","description":null,"feature_image":null,"meta_description":null,"meta_title":null,"visibility":"public"},"tags":[{"name":"Amazon Cognito","slug":"amazon-cognito","description":null,"feature_image":null,"meta_description":null,"meta_title":null,"visibility":"public"},{"name":"Go","slug":"go","description":null,"feature_image":null,"meta_description":null,"meta_title":null,"visibility":"public"}],"plaintext":"自分が関わっているサービスで、認証にAmazon Cognitoを使っています。\n\nAmazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWSAmazon Web Services, Inc.\n[https://aws.amazon.com/jp/cognito/]\n全てのリクエストについてトークンの検証をするので、APIサーバの動作確認時に必ずヘッダにトークンをセットする必要があります。このトークンを用意するのが地味に面倒だったので、Golangでスクリプトを書きました。\n\n以下の記事を参考にしました。\n\ngolangでCognito認証（ただしSecure Remote Password(SRP)プロトコルではない） - Qiita参考\nhttp://docs.aws.amazon.com/ja_jp/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.ht...\nQiitacobachan [https://qiita.com/cobachan/items/9ec379bbcc28a9d3d08a] package \nmain import ( \"fmt\" \"log\" \"os\" \"github.com/aws/aws-sdk-go/aws\" \n\"github.com/aws/aws-sdk-go/aws/session\" \n\"github.com/aws/aws-sdk-go/service/cognitoidentityprovider\" ) func main() { if \nlen(os.Args) != 3 { log.Fatal(\"invalid args\") } id := os.Args[1] password := os.\nArgs[2] params := &cognitoidentityprovider.AdminInitiateAuthInput{ AuthFlow: aws\n.String(cognitoidentityprovider.AuthFlowTypeAdminNoSrpAuth), AuthParameters: map\n[string]*string{ \"USERNAME\": aws.String(id), \"PASSWORD\": aws.String(password), \n}, ClientId: aws.String(os.Getenv(\"CLIENT_ID\")), UserPoolId: aws.String(os.\nGetenv(\"USER_POOL_ID\")), } client := cognitoidentityprovider.New( session.Must(\nsession.NewSessionWithOptions(session.Options{ SharedConfigState: session.\nSharedConfigEnable, })), ) res, err := client.AdminInitiateAuth(params) if err \n!= nil { log.Fatal(err) } if res == nil || res.AuthenticationResult == nil || \nres.AuthenticationResult.IdToken == nil { log.Fatal(\"failed to login\") } fmt.\nPrintln(*res.AuthenticationResult.IdToken) } view raw\n[https://gist.github.com/yutakahashi114/f4552724774f546a688e0935f80154c7/raw/666ff46242c2f5d04c5b93a4aea3323cbeef38e0/cognito_token.go]\n cognito_token.go\n[https://gist.github.com/yutakahashi114/f4552724774f546a688e0935f80154c7#file-cognito_token-go]\nhosted with ❤ by GitHub [https://github.com] \n引数でusernameとpasswordを指定します。sessionの生成方法は自分の環境に合わせて少し変えています。以下を参考にしました。\n\nConfiguring the AWS SDK for Go - AWS SDK for GoConfigure the |sdk-go| to\nspecify\nwhich credentials to use and to which AWS Region to send requests.AWS SDK for Go\n[https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html]\nローカルではDockerを使用しているので、簡単に使うためにMakefileに以下を追加します。\n\ntoken:\n docker-compose exec app go run main.go ${ID} ${PASS}\n\n\n以下のように実行すると、トークンが出力されます。\n\n$ make token ID=email@example.com PASS=password\n\n\n以上です。","html":"

自分が関わっているサービスで、認証にAmazon Cognitoを使っています。

\n
Amazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWS
Amazon Web Services, Inc.

全てのリクエストについてトークンの検証をするので、APIサーバの動作確認時に必ずヘッダにトークンをセットする必要があります。このトークンを用意するのが地味に面倒だったので、Golangでスクリプトを書きました。

\n

以下の記事を参考にしました。

\n
golangでCognito認証（ただしSecure Remote Password(SRP)プロトコルではない） - Qiita
参考 http://docs.aws.amazon.com/ja_jp/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.ht...
Qiitacobachan
\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
package main
\n
import (
\t"fmt"
\t"log"
\t"os"
\n
\t"github.com/aws/aws-sdk-go/aws"
\t"github.com/aws/aws-sdk-go/aws/session"
\t"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
)
\n
func main() {
\tif len(os.Args) != 3 {
\t\tlog.Fatal("invalid args")
\t}
\tid := os.Args[1]
\tpassword := os.Args[2]
\n
\tparams := &cognitoidentityprovider.AdminInitiateAuthInput{
\t\tAuthFlow: aws.String(cognitoidentityprovider.AuthFlowTypeAdminNoSrpAuth),
\t\tAuthParameters: map[string]*string{
\t\t\t"USERNAME": aws.String(id),
\t\t\t"PASSWORD": aws.String(password),
\t\t},
\t\tClientId: aws.String(os.Getenv("CLIENT_ID")),
\t\tUserPoolId: aws.String(os.Getenv("USER_POOL_ID")),
\t}
\n
\tclient := cognitoidentityprovider.New(
\t\tsession.Must(session.NewSessionWithOptions(session.Options{
\t\t\tSharedConfigState: session.SharedConfigEnable,
\t\t})),
\t)
\n
\tres, err := client.AdminInitiateAuth(params)
\tif err != nil {
\t\tlog.Fatal(err)
\t}
\tif res == nil || res.AuthenticationResult == nil || res.AuthenticationResult.IdToken == nil {
\t\tlog.Fatal("failed to login")
\t}
\tfmt.Println(*res.AuthenticationResult.IdToken)
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_token.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

引数でusernameとpasswordを指定します。sessionの生成方法は自分の環境に合わせて少し変えています。以下を参考にしました。

\n
Configuring the AWS SDK for Go - AWS SDK for Go
Configure the |sdk-go| to specify which credentials to use and to which AWS Region to send requests.
AWS SDK for Go

ローカルではDockerを使用しているので、簡単に使うためにMakefileに以下を追加します。

\n
token:\n    docker-compose exec app go run main.go ${ID} ${PASS}\n
\n

以下のように実行すると、トークンが出力されます。

\n
$ make token ID=email@example.com PASS=password\n
\n

以上です。

\n","url":"https://ghost.tech.anti-pattern.co.jp/golang-cognito/","canonical_url":null,"uuid":"592d8330-c9ba-4c38-b6fb-fc32d8b71002","page":null,"codeinjection_foot":null,"codeinjection_head":null,"codeinjection_styles":null,"comment_id":"61040a413986b000013a45df","reading_time":2}},{"node":{"id":"Ghost__Post__61040dc93986b000013a4604","title":"Amazon Cognito のローカル開発用エミュレータを作ろうとした話","slug":"amazon-cognito-emulator","featured":false,"feature_image":null,"excerpt":"自分が関わっているサービスで、認証に Amazon Cognito を使っています。\n\nAmazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWSAmazon Web Services, Inc.\n[https://aws.amazon.com/jp/cognito/]Cognito\nは公式でエミュレータ的なものは提供されていないようなので、ローカル環境では開発用の Cognito に繋いでいます。\n\n実物の Cognito を使う場合、メールをモックサーバに飛ばせないので誤送信の可能性があったり、ユーザーの追加が面倒だったりと、個人的に不便を感じていました。\n\nそのため、Cognito の動きを再現するエミュレータを作りました。\n\n今回は自分が必要な最低限の機能だけ実装しています。足りない機能は適宜追加するつもりです。\n\nとりあえず以下の機能を実装しました。\n\n * 公開鍵の取得\n * 認証\n * ユーザー作成\n\nエンドポイント\nCognito のエンドポイントは恐らく以下の2つだけです。\n\n1. GET https://cognito-idp.{region}.","custom_excerpt":null,"visibility":"public","created_at_pretty":"30 July, 2021","published_at_pretty":"29 June, 2021","updated_at_pretty":"23 August, 2021","created_at":"2021-07-30T23:33:45.000+09:00","published_at":"2021-06-30T00:00:00.000+09:00","updated_at":"2021-08-23T21:36:56.000+09:00","meta_title":null,"meta_description":null,"og_description":null,"og_image":null,"og_title":null,"twitter_description":null,"twitter_image":null,"twitter_title":null,"authors":[{"name":"Yu Takahashi","slug":"yu","bio":null,"profile_image":null,"twitter":null,"facebook":null,"website":null}],"primary_author":{"name":"Yu Takahashi","slug":"yu","bio":null,"profile_image":null,"twitter":null,"facebook":null,"website":null},"primary_tag":{"name":"Amazon Cognito","slug":"amazon-cognito","description":null,"feature_image":null,"meta_description":null,"meta_title":null,"visibility":"public"},"tags":[{"name":"Amazon Cognito","slug":"amazon-cognito","description":null,"feature_image":null,"meta_description":null,"meta_title":null,"visibility":"public"}],"plaintext":"自分が関わっているサービスで、認証に Amazon Cognito を使っています。\n\nAmazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWSAmazon Web Services, Inc.\n[https://aws.amazon.com/jp/cognito/]Cognito\nは公式でエミュレータ的なものは提供されていないようなので、ローカル環境では開発用の Cognito に繋いでいます。\n\n実物の Cognito を使う場合、メールをモックサーバに飛ばせないので誤送信の可能性があったり、ユーザーの追加が面倒だったりと、個人的に不便を感じていました。\n\nそのため、Cognito の動きを再現するエミュレータを作りました。\n\n今回は自分が必要な最低限の機能だけ実装しています。足りない機能は適宜追加するつもりです。\n\nとりあえず以下の機能を実装しました。\n\n * 公開鍵の取得\n * 認証\n * ユーザー作成\n\nエンドポイント\nCognito のエンドポイントは恐らく以下の2つだけです。\n\n1. GET https://cognito-idp.{region}.amazonaws.com/{user-pool-id}/.well-known/jwks.json\n2. POST https://cognito-idp.{region}.amazonaws.com/\n\n\n 1. は公開鍵の取得、2. はそれ以外の操作（認証やユーザーの作成、削除）に使います。\n\n公開鍵の取得\n 1. のエンドポイントを叩くと、以下のような json が返ってきます。\n\n{ \n \"keys\": [ \n { \n \"alg\": \"RS256\", \n \"e\": \"XXXX\", \n \"kid\": \"xxxxkid\", \n \"kty\": \"RSA\", \n \"n\": \"xxxx...\", \n \"use\": \"sig\" \n },\n ...\n ] \n}\n\n\nRSA で暗号化しているようなので、まずは鍵を作成します。以下を参考にしました。\n\njwt-goを用いた、GolangでのJWTの発行、認証について - QiitaGolangでJWT（JSON Web\nToken）を取り扱いたいと思い、jwt-goの使い方を調べました。 JWTについての説明は他の有益な解説サイトがあるので、そちらを参考にして下さい。\n早速実装の説明に入ります。 Rou...Qiitawh1teB0x\n[https://qiita.com/wh1teB0x/items/e2133eeb94f57629b5e7]Encode Private Key\ngetting Error: asn1: structure error: tags don’t matchWhen i try to parses the\nencode private key with sample private key -----BEGIN OPENSSH PRIVATE\nKEY-----b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\nStack OverflowBlack_Dreams\n[https://stackoverflow.com/questions/55470311/encode-private-key-getting-error-asn1-structure-error-tags-dont-match]\nターミナルで以下を実行します。\n\n$ ssh-keygen -t rsa -f key.pem -m pem \n$ ssh-keygen -f key.pem.pub -e -m pkcs8 > key.pem.pub.pkcs8\n\n\nkey.pem が秘密鍵、key.pem.pub.pkcs8 が公開鍵です。\n\nkey.pem.pub.pkcs8を以下のように読み込んで整形します。\n\nimport ( \"encoding/base64\" \"encoding/binary\" \"encoding/json\" \"io/ioutil\" \n\"github.com/dgrijalva/jwt-go\" ) const jwkKeyID = \"hoge\" type jwkKey struct { Alg \n string `json:\"alg\"` E string `json:\"e\"` Kid string `json:\"kid\"` Kty string \n`json:\"kty\"` N string `json:\"n\"` Use string `json:\"use\"` } func getPublicKey() (\nstring, error) { verifyBytes, err := ioutil.ReadFile(\"./key.pem.pub.pkcs8\") if \nerr != nil { return \"\", err } verifyKey, err := jwt.ParseRSAPublicKeyFromPEM(\nverifyBytes) if err != nil { return \"\", err } encodedN := base64.RawURLEncoding.\nEncodeToString(verifyKey.N.Bytes()) bytesE := make([]byte, 4) binary.BigEndian.\nPutUint32(bytesE, uint32(verifyKey.E)) encodedE := base64.RawURLEncoding.\nEncodeToString(bytesE) pubKey, err := json.Marshal(jwkKey{ Alg: jwt.\nSigningMethodRS256.Alg(), E: encodedE, Kid: jwkKeyID, Kty: \"RSA\", N: encodedN, \nUse: \"sig\", }) if err != nil { return \"\", err } return string(pubKey), nil } \nview raw\n[https://gist.github.com/yutakahashi114/01ad8e5ae7e1a3f886f4be4f6b217ec1/raw/ee469b087678297a60343a573ba7239b934bf737/cognito_public_key.go]\n cognito_public_key.go\n[https://gist.github.com/yutakahashi114/01ad8e5ae7e1a3f886f4be4f6b217ec1#file-cognito_public_key-go]\nhosted with ❤ by GitHub [https://github.com] kid は鍵を識別するための ID ですが、後述する token の header にセットした値と一致していれば何でも良いです。\n\n整形した鍵を json で返すエンドポイントを作成します。\n\nimport ( \"fmt\" \"log\" \"net/http\" \"github.com/go-chi/chi/v5\" \n\"github.com/go-chi/chi/v5/middleware\" ) func main() { pubKeyString, err := \ngetPublicKey() if err != nil { panic(err) } mux := chi.NewRouter() mux.Use(\nmiddleware.Logger) mux.Get(\"/{userPoolID}/.well-known/jwks.json\", func(w http.\nResponseWriter, r *http.Request) { w.Write([]byte(fmt.Sprintf(`{\"keys\":[%s]}`, \npubKeyString))) }) log.Println(http.ListenAndServe(\":80\", mux)) } view raw\n[https://gist.github.com/yutakahashi114/5efe826eef370b141e479336da674600/raw/9f48f8bb74e659257c1e17b93f33609753d0a5d3/cognito_public_key_endpoint.go]\n cognito_public_key_endpoint.go\n[https://gist.github.com/yutakahashi114/5efe826eef370b141e479336da674600#file-cognito_public_key_endpoint-go]\nhosted with ❤ by GitHub [https://github.com] 恐らく実際はuserPoolID ごとに異なる鍵を返していると思いますが、面倒なので全ての ID で同じ 鍵を返しています。\n\nこれで公開鍵の取得エンドポイントは完成です。\n\nユーザー情報\n実際にどんな感じで保存しているかは分かりませんが、ここでは json 形式でファイルに保存するようにしました。\n\n{ \"user-pool-id-hoge\": { \"username-hoge\": { \"uuid\": \"\n208b377c-e86e-3f1d-a23c-cdab84d86901\", \"password\": \"password\", \"username\": \"\nusername-hoge\", \"email\": \"email@example.com\", \"email_verified\": true } } } view\nraw\n[https://gist.github.com/yutakahashi114/3cbf0c3f69770d1dbe45648d011c5e9a/raw/acad96791dac283e662f4cdad3d9da6e99312760/cognito_user_pool.json]\n cognito_user_pool.json\n[https://gist.github.com/yutakahashi114/3cbf0c3f69770d1dbe45648d011c5e9a#file-cognito_user_pool-json]\nhosted with ❤ by GitHub [https://github.com] import ( \"encoding/json\" \"fmt\" \n\"sync\" ) const poolFileName = \"pool.json\" func main() { data, err := ioutil.\nReadFile(poolFileName) if err != nil { panic(err) } poolMap := make(map[\nUserPoolID]UserMap) err = json.Unmarshal(data, &poolMap) if err != nil { panic(\nerr) } userPool = UserPool{ poolMap: poolMap, mutex: &sync.Mutex{}, } ... } type \n User struct { UUID string `json:\"uuid\"` Password string `json:\"password\"` \nUsername Username `json:\"username\"` Email string `json:\"email\"` EmailVerified \nbool `json:\"email_verified\"` } type Username string type UserMap map[Username]*\nUser type UserPoolID string type UserPool struct { poolMap map[UserPoolID]\nUserMap mutex *sync.Mutex } func (pool UserPool) GetUser(userPoolID UserPoolID, \nusername Username) (*User, bool) { pool.mutex.Lock() defer pool.mutex.Unlock() \nreturn pool.getUser(userPoolID, username) } func (pool UserPool) getUser(\nuserPoolID UserPoolID, username Username) (*User, bool) { uMap, ok := pool.\npoolMap[userPoolID] if !ok { return nil, false } u, ok := uMap[username] if !ok \n{ return nil, false } return u, true } func (pool UserPool) CreateUser(\nuserPoolID UserPoolID, user User) error { pool.mutex.Lock() defer pool.mutex.\nUnlock() uMap, ok := pool.poolMap[userPoolID] if !ok { uMap = make(UserMap) pool\n.poolMap[userPoolID] = uMap } if _, ok := uMap[user.Username]; ok { return fmt.\nErrorf(\"already exist\") } uMap[user.Username] = &user return pool.updateFile() } \nfunc (pool UserPool) updateFile() error { file, err := os.Create(poolFileName) \nif err != nil { return err } defer file.Close() content, err := json.Marshal(\npool.poolMap) if err != nil { return err } _, err = file.Write(content) return \nerr } func (pool UserPool) DeleteUser(userPoolID UserPoolID, username Username) \nerror { pool.mutex.Lock() defer pool.mutex.Unlock() if _, exist := pool.getUser(\nuserPoolID, username); exist { delete(pool.poolMap[userPoolID], username) } \nreturn pool.updateFile() } view raw\n[https://gist.github.com/yutakahashi114/76c063408fc8a79ebe643df9ad39214a/raw/01f5eafe6c352b1460605bc297607ab0a3f3e551/cognito_user_pool.go]\n cognito_user_pool.go\n[https://gist.github.com/yutakahashi114/76c063408fc8a79ebe643df9ad39214a#file-cognito_user_pool-go]\nhosted with ❤ by GitHub [https://github.com] main 実行時にpool.json を読み込み、map で保持します。map\nにユーザーを追加、削除する度にファイルを更新しています。パフォーマンスは悪そうですが、そこまで気にしてないので良しとしています。\n\nユーザー情報を拡張する場合は構造体のフィールドを追加するなどして対応できると思います。\n\nルーティング\n公開鍵の取得以外は全て同じエンドポイントですが、リクエストの識別にはヘッダを使用しています。\n\nX-Amz-Target というキーにAWSCognitoIdentityProviderService.AdminInitiateAuth \nのような形式でセットされているので、これを使います。\n\nimport ( \"fmt\" \"io/ioutil\" \"log\" \"net/http\" \"strings\" \"github.com/go-chi/chi/v5\" \n\"github.com/go-chi/render\" ) func main() { ... mux.Post(\"/\", func(w http.\nResponseWriter, r *http.Request) { b, err := ioutil.ReadAll(r.Body) if err != \nnil { render.JSON(w, r, http.StatusInternalServerError) return } defer r.Body.\nClose() out, err := route(r.Header.Get(\"X-Amz-Target\"), b) if err != nil { log.\nPrintln(err) render.JSON(w, r, http.StatusInternalServerError) return } w.\nWriteHeader(http.StatusOK) w.Write(out) }) log.Println(http.ListenAndServe(\":80\"\n, mux)) } func route(xAmzTarget string, body []byte) ([]byte, error) { targets \n:= strings.Split(xAmzTarget, \".\") if len(targets) < 2 { return nil, fmt.Errorf(\n\"invalid header\") } switch targets[1] { case \"AdminInitiateAuth\": return \nadminInitiateAuth(body) case \"AdminCreateUser\": return adminCreateUser(body) ... \n} return nil, fmt.Errorf(\"invalid operation name\") } view raw\n[https://gist.github.com/yutakahashi114/99d46c09c0d47f8bf9cf703e46ea1348/raw/e435dfb4d7bc2b65725ec6ffb91d0b368ea25574/cognito_route.go]\n cognito_route.go\n[https://gist.github.com/yutakahashi114/99d46c09c0d47f8bf9cf703e46ea1348#file-cognito_route-go]\nhosted with ❤ by GitHub [https://github.com] 認証\n公開鍵と同じように秘密鍵を読み込みます。clientID は環境変数から読み取ります。\n\nimport ( \"crypto/rsa\" \"encoding/json\" \"fmt\" \"io/ioutil\" \"log\" \"time\" \n\"github.com/aws/aws-sdk-go/service/cognitoidentityprovider\" \n\"github.com/dgrijalva/jwt-go\" ) var signKey *rsa.PrivateKey var clientID \nClientID type ClientID string func main() { ... signKey, err = getPrivateKey() \nif err != nil { panic(err) } clientID = ClientID(os.Getenv(\"CLIENT_ID\")) ... } \nfunc getPrivateKey() (*rsa.PrivateKey, error) { signBytes, err := ioutil.\nReadFile(\"./key.pem\") if err != nil { return nil, err } return jwt.\nParseRSAPrivateKeyFromPEM(signBytes) } func (u User) ToToken(userPoolID \nUserPoolID) *jwt.Token { token := jwt.New(jwt.SigningMethodRS256) token.Header[\n\"kid\"] = jwkKeyID claims := token.Claims.(jwt.MapClaims) claims[\"iat\"] = time.\nNow().Unix() claims[\"exp\"] = time.Now().Add(time.Hour * 24 * 365 * 10).Unix() \nclaims[\"sub\"] = u.UUID claims[\"email\"] = u.Email return token } func \nadminInitiateAuth(body []byte) ([]byte, error) { in := cognitoidentityprovider.\nAdminInitiateAuthInput{} err := json.Unmarshal(body, &in) if err != nil { return \n nil, err } // TODO: まだ ADMIN_NO_SRP_AUTH だけ if in.AuthFlow == nil || *in.\nAuthFlow != cognitoidentityprovider.AuthFlowTypeAdminNoSrpAuth { return nil, fmt\n.Errorf(\"invalid auth flow\") } var cID ClientID if in.ClientId != nil { cID = \nClientID(*in.ClientId) } if cID != clientID { return nil, fmt.Errorf(\"invalid\nclient id\") } var userPoolID UserPoolID if in.UserPoolId != nil { userPoolID = \nUserPoolID(*in.UserPoolId) } var username Username if u, ok := in.AuthParameters\n[\"USERNAME\"]; ok && u != nil { username = Username(*u) } u, ok := userPool.\nGetUser( userPoolID, username, ) if !ok { return nil, fmt.Errorf(\"user not\nfound\") } if !u.EmailVerified { return nil, fmt.Errorf(\"email not verified\") } \nvar password string if p, ok := in.AuthParameters[\"PASSWORD\"]; ok && p != nil { \npassword = *p } if u.Password != password { return nil, fmt.Errorf(\"password not\nmatch\") } tokenString, err := u.ToToken(userPoolID).SignedString(signKey) if err \n != nil { return nil, err } return json.Marshal(cognitoidentityprovider.\nAdminInitiateAuthOutput{ AuthenticationResult: &cognitoidentityprovider.\nAuthenticationResultType{ AccessToken: &[]string{tokenString}[0], }, }) } view\nraw\n[https://gist.github.com/yutakahashi114/794add8f02eac1fa4a1d4168df264793/raw/f36b4cdb06eb1e3902f038d96c6df45e8955b7b4/cognito_admin_initiate_auth.go]\n cognito_admin_initiate_auth.go\n[https://gist.github.com/yutakahashi114/794add8f02eac1fa4a1d4168df264793#file-cognito_admin_initiate_auth-go]\nhosted with ❤ by GitHub [https://github.com] requestBody はgithub.com/aws/aws-sdk-go/service/cognitoidentityprovider \nの構造体を使ってそのままパースできます。\n\nclaims には最低限の情報をセットしていますが、実際に使うには足りないと思うので、以下を参考に必要に応じて情報を追加します。\n\nUsing the ID Token - Amazon CognitoUsing the ID TokenAmazon Cognito\n[https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-id-token.html]\n読み込んだ秘密鍵で署名し、トークン文字列に変換します。ここではAccessToken にセットしていますが、使い方によってはIdToken \n等にセットするかもしれません。\n\nユーザー作成\nimport ( \"encoding/json\" \"fmt\" \"math/rand\" \n\"github.com/aws/aws-sdk-go/service/cognitoidentityprovider\" \n\"github.com/gofrs/uuid\" ) func adminCreateUser(body []byte) ([]byte, error) { in \n := cognitoidentityprovider.AdminCreateUserInput{} err := json.Unmarshal(body, &\nin) if err != nil { return nil, err } var userPoolID UserPoolID if in.UserPoolId \n != nil { userPoolID = UserPoolID(*in.UserPoolId) } var username Username if in.\nUsername != nil { username = Username(*in.Username) } if in.MessageAction != nil \n && *in.MessageAction == \"RESEND\" { if _, exist := userPool.GetUser(userPoolID, \nusername); !exist { return nil, fmt.Errorf(\"user not found\") } // TODO:\nパスワード変更して通知メール再送信 return json.Marshal(cognitoidentityprovider.\nAdminCreateUserOutput{}) } var email string for _, attr := range in.\nUserAttributes { if attr.Name == nil || attr.Value == nil { continue } if *attr.\nName == \"email\" { email = *attr.Value } } // TODO: email_verified が true\nならパスワードメール送信, false なら検証メール送信 // 常にtrueとして扱っている if email == \"\" { return nil, fmt\n.Errorf(\"invalid email\") } id, err := uuid.NewV4() if err != nil { return nil, \nerr } pass, err := makeRandomStr(8) if err != nil { return nil, err } idString \n:= id.String() user := User{ UUID: idString, Password: pass, Username: username, \nEmail: email, EmailVerified: true, } err = userPool.CreateUser(userPoolID, user) \nif err != nil { return nil, err } return json.Marshal(cognitoidentityprovider.\nAdminCreateUserOutput{ User: &cognitoidentityprovider.UserType{ Attributes: []*\ncognitoidentityprovider.AttributeType{ { Name: &[]string{\"sub\"}[0], Value: &[]\nstring{idString}[0], }, }, }, }) } func makeRandomStr(digit uint32) (string, \nerror) { const letters = \n\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@&%/:;,.\" b := \nmake([]byte, digit) if _, err := rand.Read(b); err != nil { return \"\", err } var \n result string for _, v := range b { result += string(letters[int(v)%len(letters\n)]) } return result, nil } view raw\n[https://gist.github.com/yutakahashi114/cec3b852b6abface3fcd772cd2c13985/raw/0711f52c9476a4beccdf8f51510249cc1c6804e6/cognito_admin_create_user.go]\n cognito_admin_create_user.go\n[https://gist.github.com/yutakahashi114/cec3b852b6abface3fcd772cd2c13985#file-cognito_admin_create_user-go]\nhosted with ❤ by GitHub [https://github.com] \n全て検証済みのユーザーとして作成しています。メール送信部分は省いていますが、そのうち追加予定です。\n\nランダム文字列生成は以下を参考にしました。\n\ngolang でランダム文字列生成 - QiitaGo\nでは乱数を返すライブラリはあれど、ランダム文字列を返すライブラリがない（少なくとも今の所は）。というわけで、パスワードなどでランダムな文字列を生成したい場合は自分で書く必要がある。\nちなみに乱数を生成するには math/ra...Qiitanakaryooo\n[https://qiita.com/nakaryooo/items/7d269525a288c4b3ecda]アプリ側の設定\nCognito のクライアント生成時に、特定の環境変数を設定している場合はそちらに繋ぐように変更します。\n\nvar endpoint *string cognitoEndpoint = os.Getenv(\"COGNITO_ENDPOINT\") if \ncognitoEndpoint != \"\" { endpoint = aws.String(cognitoEndpoint) } client := \ncognitoidentityprovider.New( session.Must(session.NewSessionWithOptions(session.\nOptions{ Config: aws.Config{Endpoint: endpoint}, SharedConfigState: session.\nSharedConfigEnable, })), ) view raw\n[https://gist.github.com/yutakahashi114/9f58aedb19bfb4f8b1f2d2cc347a9428/raw/eda88469f24973dff6a9884b657c4e90a7d36c92/cognito_session_endpoint.go]\n cognito_session_endpoint.go\n[https://gist.github.com/yutakahashi114/9f58aedb19bfb4f8b1f2d2cc347a9428#file-cognito_session_endpoint-go]\nhosted with ❤ by GitHub [https://github.com] Configuring the AWS SDK for Go -\nAWS SDK for GoConfigure the |sdk-go| to specify which credentials to use and to\nwhich AWS Region to send requests.AWS SDK for Go\n[https://docs.aws.amazon.com/ja_jp/sdk-for-go/v1/developer-guide/configuring-sdk.html]\nまとめ\nすべてまとめると以下になります。コードが散らかってるのでもう少し整理したいところです…\n\n汎用的なものが作れたら Docker Hub に上げようかなと思っていましたが、中々難しそうです。\n\npackage main import ( \"crypto/rsa\" \"encoding/base64\" \"encoding/binary\" \n\"encoding/json\" \"fmt\" \"io/ioutil\" \"log\" \"math/rand\" \"net/http\" \"os\" \"strings\" \n\"sync\" \"time\" \"github.com/aws/aws-sdk-go/service/cognitoidentityprovider\" \n\"github.com/dgrijalva/jwt-go\" \"github.com/go-chi/chi/v5\" \n\"github.com/go-chi/chi/v5/middleware\" \"github.com/go-chi/render\" \n\"github.com/gofrs/uuid\" ) var userPool UserPool var clientID ClientID var \nsignKey *rsa.PrivateKey const jwkKeyID = \"hoge\" const poolFileName = \"pool.json\" \nfunc main() { data, err := ioutil.ReadFile(poolFileName) if err != nil { panic(\nerr) } poolMap := make(map[UserPoolID]UserMap) err = json.Unmarshal(data, &\npoolMap) if err != nil { panic(err) } userPool = UserPool{ poolMap: poolMap, \nmutex: &sync.Mutex{}, } clientID = ClientID(os.Getenv(\"CLIENT_ID\")) signKey, err \n = getPrivateKey() if err != nil { panic(err) } pubKeyString, err := \ngetPublicKey() if err != nil { panic(err) } mux := chi.NewRouter() mux.Use(\nmiddleware.Logger) mux.Get(\"/{userPoolID}/.well-known/jwks.json\", func(w http.\nResponseWriter, r *http.Request) { w.Write([]byte(fmt.Sprintf(`{\"keys\":[%s]}`, \npubKeyString))) }) mux.Post(\"/\", func(w http.ResponseWriter, r *http.Request) { \nb, err := ioutil.ReadAll(r.Body) if err != nil { render.JSON(w, r, http.\nStatusInternalServerError) return } defer r.Body.Close() out, err := route(r.\nHeader.Get(\"X-Amz-Target\"), b) if err != nil { log.Println(err) render.JSON(w, r\n, http.StatusInternalServerError) return } w.WriteHeader(http.StatusOK) w.Write(\nout) }) log.Println(http.ListenAndServe(\":80\", mux)) } type User struct { UUID \nstring `json:\"uuid\"` Password string `json:\"password\"` Username Username \n`json:\"username\"` Email string `json:\"email\"` EmailVerified bool \n`json:\"email_verified\"` } func (u User) ToToken(userPoolID UserPoolID) *jwt.\nToken { token := jwt.New(jwt.SigningMethodRS256) token.Header[\"kid\"] = jwkKeyID \nclaims := token.Claims.(jwt.MapClaims) claims[\"iat\"] = time.Now().Unix() claims[\n\"exp\"] = time.Now().Add(time.Hour * 24 * 365 * 10).Unix() claims[\"sub\"] = u.UUID \nclaims[\"email\"] = u.Email return token } type ClientID string type Username \nstring type UserMap map[Username]*User type UserPoolID string type UserPool \nstruct { poolMap map[UserPoolID]UserMap mutex *sync.Mutex } func (pool UserPool) \nGetUser(userPoolID UserPoolID, username Username) (*User, bool) { pool.mutex.\nLock() defer pool.mutex.Unlock() return pool.getUser(userPoolID, username) } \nfunc (pool UserPool) getUser(userPoolID UserPoolID, username Username) (*User, \nbool) { uMap, ok := pool.poolMap[userPoolID] if !ok { return nil, false } u, ok \n:= uMap[username] if !ok { return nil, false } return u, true } func (pool \nUserPool) CreateUser(userPoolID UserPoolID, user User) error { pool.mutex.Lock() \ndefer pool.mutex.Unlock() uMap, ok := pool.poolMap[userPoolID] if !ok { uMap = \nmake(UserMap) pool.poolMap[userPoolID] = uMap } if _, ok := uMap[user.Username]; \nok { return fmt.Errorf(\"already exist\") } uMap[user.Username] = &user return \npool.updateFile() } func (pool UserPool) updateFile() error { file, err := os.\nCreate(poolFileName) if err != nil { return err } defer file.Close() content, \nerr := json.Marshal(pool.poolMap) if err != nil { return err } _, err = file.\nWrite(content) return err } func (pool UserPool) DeleteUser(userPoolID \nUserPoolID, username Username) error { pool.mutex.Lock() defer pool.mutex.Unlock\n() if _, exist := pool.getUser(userPoolID, username); exist { delete(pool.\npoolMap[userPoolID], username) } return pool.updateFile() } type jwkKey struct { \nAlg string `json:\"alg\"` E string `json:\"e\"` Kid string `json:\"kid\"` Kty string \n`json:\"kty\"` N string `json:\"n\"` Use string `json:\"use\"` } func getPublicKey() (\nstring, error) { verifyBytes, err := ioutil.ReadFile(\"./key.pem.pub.pkcs8\") if \nerr != nil { return \"\", err } verifyKey, err := jwt.ParseRSAPublicKeyFromPEM(\nverifyBytes) if err != nil { return \"\", err } encodedN := base64.RawURLEncoding.\nEncodeToString(verifyKey.N.Bytes()) bytesE := make([]byte, 4) binary.BigEndian.\nPutUint32(bytesE, uint32(verifyKey.E)) encodedE := base64.RawURLEncoding.\nEncodeToString(bytesE) pubKey, err := json.Marshal(jwkKey{ Alg: jwt.\nSigningMethodRS256.Alg(), E: encodedE, Kid: jwkKeyID, Kty: \"RSA\", N: encodedN, \nUse: \"sig\", }) if err != nil { return \"\", err } return string(pubKey), nil } \nfunc getPrivateKey() (*rsa.PrivateKey, error) { signBytes, err := ioutil.\nReadFile(\"./key.pem\") if err != nil { return nil, err } return jwt.\nParseRSAPrivateKeyFromPEM(signBytes) } func route(xAmzTarget string, body []byte\n) ([]byte, error) { log.Println(xAmzTarget) targets := strings.Split(xAmzTarget, \n\".\") if len(targets) < 2 { return nil, fmt.Errorf(\"invalid header\") } switch \ntargets[1] { case \"AdminInitiateAuth\": return adminInitiateAuth(body) case \n\"AdminCreateUser\": return adminCreateUser(body) } return nil, fmt.Errorf(\n\"invalid operation name\") } func adminInitiateAuth(body []byte) ([]byte, error)\n{ in := cognitoidentityprovider.AdminInitiateAuthInput{} err := json.Unmarshal(\nbody, &in) if err != nil { return nil, err } // TODO: まだ ADMIN_NO_SRP_AUTH だけ if \n in.AuthFlow == nil || *in.AuthFlow != cognitoidentityprovider.\nAuthFlowTypeAdminNoSrpAuth { return nil, fmt.Errorf(\"invalid auth flow\") } var \ncID ClientID if in.ClientId != nil { cID = ClientID(*in.ClientId) } if cID != \nclientID { return nil, fmt.Errorf(\"invalid client id\") } var userPoolID \nUserPoolID if in.UserPoolId != nil { userPoolID = UserPoolID(*in.UserPoolId) } \nvar username Username if u, ok := in.AuthParameters[\"USERNAME\"]; ok && u != nil \n{ username = Username(*u) } u, ok := userPool.GetUser( userPoolID, username, ) \nif !ok { return nil, fmt.Errorf(\"user not found\") } if !u.EmailVerified { return \n nil, fmt.Errorf(\"email not verified\") } var password string if p, ok := in.\nAuthParameters[\"PASSWORD\"]; ok && p != nil { password = *p } if u.Password != \npassword { return nil, fmt.Errorf(\"password not match\") } tokenString, err := u.\nToToken(userPoolID).SignedString(signKey) if err != nil { return nil, err } \nreturn json.Marshal(cognitoidentityprovider.AdminInitiateAuthOutput{ \nAuthenticationResult: &cognitoidentityprovider.AuthenticationResultType{ \nAccessToken: &[]string{tokenString}[0], }, }) } func adminCreateUser(body []byte\n) ([]byte, error) { in := cognitoidentityprovider.AdminCreateUserInput{} err := \njson.Unmarshal(body, &in) if err != nil { return nil, err } var userPoolID \nUserPoolID if in.UserPoolId != nil { userPoolID = UserPoolID(*in.UserPoolId) } \nvar username Username if in.Username != nil { username = Username(*in.Username) \n} if in.MessageAction != nil && *in.MessageAction == \"RESEND\" { if _, exist := \nuserPool.GetUser(userPoolID, username); !exist { return nil, fmt.Errorf(\"user\nnot found\") } // TODO: パスワード変更して通知メール再送信 return json.Marshal\n(cognitoidentityprovider.AdminCreateUserOutput{}) } var email string for _, attr \n := range in.UserAttributes { if attr.Name == nil || attr.Value == nil { \ncontinue } if *attr.Name == \"email\" { email = *attr.Value } } // TODO:\nemail_verified が true ならパスワードメール送信, false なら検証メール送信 // 常にtrueとして扱っている if email \n== \"\" { return nil, fmt.Errorf(\"invalid email\") } id, err := uuid.NewV4() if err \n != nil { return nil, err } pass, err := makeRandomStr(8) if err != nil { return \n nil, err } idString := id.String() user := User{ UUID: idString, Password: pass\n, Username: username, Email: email, EmailVerified: true, } err = userPool.\nCreateUser(userPoolID, user) if err != nil { return nil, err } return json.\nMarshal(cognitoidentityprovider.AdminCreateUserOutput{ User: &\ncognitoidentityprovider.UserType{ Attributes: []*cognitoidentityprovider.\nAttributeType{ { Name: &[]string{\"sub\"}[0], Value: &[]string{idString}[0], }, }, \n}, }) } func makeRandomStr(digit uint32) (string, error) { const letters = \n\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@&%/:;,.\" b := \nmake([]byte, digit) if _, err := rand.Read(b); err != nil { return \"\", err } var \n result string for _, v := range b { result += string(letters[int(v)%len(letters\n)]) } return result, nil } view raw\n[https://gist.github.com/yutakahashi114/c2205e6feb06cad3bee470b665a0dd33/raw/a7c159f9563c64a9bcd7a07d7338bf6024cd371b/cognito_mock.go]\n cognito_mock.go\n[https://gist.github.com/yutakahashi114/c2205e6feb06cad3bee470b665a0dd33#file-cognito_mock-go]\nhosted with ❤ by GitHub [https://github.com]","html":"

自分が関わっているサービスで、認証に Amazon Cognito を使っています。

\n
Amazon Cognito（ウェブ/モバイルアプリのユーザー管理）| AWS
Amazon Web Services, Inc.

Cognito は公式でエミュレータ的なものは提供されていないようなので、ローカル環境では開発用の Cognito に繋いでいます。

\n

実物の Cognito を使う場合、メールをモックサーバに飛ばせないので誤送信の可能性があったり、ユーザーの追加が面倒だったりと、個人的に不便を感じていました。

\n

そのため、Cognito の動きを再現するエミュレータを作りました。

\n

今回は自分が必要な最低限の機能だけ実装しています。足りない機能は適宜追加するつもりです。

\n

とりあえず以下の機能を実装しました。

\n\n

エンドポイント

\n

Cognito のエンドポイントは恐らく以下の2つだけです。

\n
1. GET https://cognito-idp.{region}.amazonaws.com/{user-pool-id}/.well-known/jwks.json\n2. POST https://cognito-idp.{region}.amazonaws.com/\n
\n
    \n
  1. は公開鍵の取得、2. はそれ以外の操作（認証やユーザーの作成、削除）に使います。
    2. \n
\n

公開鍵の取得

\n
    \n
  1. のエンドポイントを叩くと、以下のような json が返ってきます。
    2. \n
\n
{  \n  "keys": [  \n    {  \n      "alg": "RS256",  \n      "e": "XXXX",  \n      "kid": "xxxxkid",  \n      "kty": "RSA",  \n      "n": "xxxx...",  \n      "use": "sig"  \n    },\n    ...\n  ]  \n}\n
\n

RSA で暗号化しているようなので、まずは鍵を作成します。以下を参考にしました。

\n
jwt-goを用いた、GolangでのJWTの発行、認証について - Qiita
GolangでJWT（JSON Web Token）を取り扱いたいと思い、jwt-goの使い方を調べました。 JWTについての説明は他の有益な解説サイトがあるので、そちらを参考にして下さい。 早速実装の説明に入ります。 Rou...
Qiitawh1teB0x
Encode Private Key getting Error: asn1: structure error: tags don’t match
When i try to parses the encode private key with sample private key -----BEGIN OPENSSH PRIVATE KEY-----b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
Stack OverflowBlack_Dreams

ターミナルで以下を実行します。

\n
$ ssh-keygen -t rsa -f key.pem -m pem  \n$ ssh-keygen -f key.pem.pub -e -m pkcs8 > key.pem.pub.pkcs8\n
\n

key.pem が秘密鍵、key.pem.pub.pkcs8 が公開鍵です。

\n

key.pem.pub.pkcs8を以下のように読み込んで整形します。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"encoding/base64"
\t"encoding/binary"
\t"encoding/json"
\t"io/ioutil"
\n
\t"github.com/dgrijalva/jwt-go"
)
\n
const jwkKeyID = "hoge"
\n
type jwkKey struct {
\tAlg string `json:"alg"`
\tE string `json:"e"`
\tKid string `json:"kid"`
\tKty string `json:"kty"`
\tN string `json:"n"`
\tUse string `json:"use"`
}
\n
func getPublicKey() (string, error) {
\tverifyBytes, err := ioutil.ReadFile("./key.pem.pub.pkcs8")
\tif err != nil {
\t\treturn "", err
\t}
\tverifyKey, err := jwt.ParseRSAPublicKeyFromPEM(verifyBytes)
\tif err != nil {
\t\treturn "", err
\t}
\n
\tencodedN := base64.RawURLEncoding.EncodeToString(verifyKey.N.Bytes())
\n
\tbytesE := make([]byte, 4)
\tbinary.BigEndian.PutUint32(bytesE, uint32(verifyKey.E))
\n
\tencodedE := base64.RawURLEncoding.EncodeToString(bytesE)
\n
\tpubKey, err := json.Marshal(jwkKey{
\t\tAlg: jwt.SigningMethodRS256.Alg(),
\t\tE: encodedE,
\t\tKid: jwkKeyID,
\t\tKty: "RSA",
\t\tN: encodedN,
\t\tUse: "sig",
\t})
\tif err != nil {
\t\treturn "", err
\t}
\treturn string(pubKey), nil
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_public_key.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

kid は鍵を識別するための ID ですが、後述する token の header にセットした値と一致していれば何でも良いです。

\n

整形した鍵を json で返すエンドポイントを作成します。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"fmt"
\t"log"
\t"net/http"
\n
\t"github.com/go-chi/chi/v5"
\t"github.com/go-chi/chi/v5/middleware"
)
\n
func main() {
\tpubKeyString, err := getPublicKey()
\tif err != nil {
\t\tpanic(err)
\t}
\n
\tmux := chi.NewRouter()
\tmux.Use(middleware.Logger)
\tmux.Get("/{userPoolID}/.well-known/jwks.json", func(w http.ResponseWriter, r *http.Request) {
\t\tw.Write([]byte(fmt.Sprintf(`{"keys":[%s]}`, pubKeyString)))
\t})
\tlog.Println(http.ListenAndServe(":80", mux))
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_public_key_endpoint.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

恐らく実際はuserPoolID ごとに異なる鍵を返していると思いますが、面倒なので全ての ID で同じ 鍵を返しています。

\n

これで公開鍵の取得エンドポイントは完成です。

\n

ユーザー情報

\n

実際にどんな感じで保存しているかは分かりませんが、ここでは json 形式でファイルに保存するようにしました。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
{
\t"user-pool-id-hoge": {
\t\t"username-hoge": {
\t\t\t"uuid": "208b377c-e86e-3f1d-a23c-cdab84d86901",
\t\t\t"password": "password",
\t\t\t"username": "username-hoge",
\t\t\t"email": "email@example.com",
\t\t\t"email_verified": true
\t\t}
\t}
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_user_pool.json\n hosted with ❤ by GitHub\n
\n
\n
\n\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"encoding/json"
\t"fmt"
\t"sync"
)
\n
const poolFileName = "pool.json"
\n
func main() {
\tdata, err := ioutil.ReadFile(poolFileName)
\tif err != nil {
\t\tpanic(err)
\t}
\tpoolMap := make(map[UserPoolID]UserMap)
\terr = json.Unmarshal(data, &poolMap)
\tif err != nil {
\t\tpanic(err)
\t}
\tuserPool = UserPool{
\t\tpoolMap: poolMap,
\t\tmutex: &sync.Mutex{},
\t}
\n
\t...
}
\n
type User struct {
\tUUID string `json:"uuid"`
\tPassword string `json:"password"`
\tUsername Username `json:"username"`
\tEmail string `json:"email"`
\tEmailVerified bool `json:"email_verified"`
}
\n
type Username string
\n
type UserMap map[Username]*User
\n
type UserPoolID string
\n
type UserPool struct {
\tpoolMap map[UserPoolID]UserMap
\tmutex *sync.Mutex
}
\n
func (pool UserPool) GetUser(userPoolID UserPoolID, username Username) (*User, bool) {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\treturn pool.getUser(userPoolID, username)
}
\n
func (pool UserPool) getUser(userPoolID UserPoolID, username Username) (*User, bool) {
\tuMap, ok := pool.poolMap[userPoolID]
\tif !ok {
\t\treturn nil, false
\t}
\tu, ok := uMap[username]
\tif !ok {
\t\treturn nil, false
\t}
\treturn u, true
}
\n
func (pool UserPool) CreateUser(userPoolID UserPoolID, user User) error {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\t
\tuMap, ok := pool.poolMap[userPoolID]
\tif !ok {
\t\tuMap = make(UserMap)
\t\tpool.poolMap[userPoolID] = uMap
\t}
\tif _, ok := uMap[user.Username]; ok {
\t\treturn fmt.Errorf("already exist")
\t}
\tuMap[user.Username] = &user
\treturn pool.updateFile()
}
\n
func (pool UserPool) updateFile() error {
\tfile, err := os.Create(poolFileName)
\tif err != nil {
\t\treturn err
\t}
\tdefer file.Close()
\tcontent, err := json.Marshal(pool.poolMap)
\tif err != nil {
\t\treturn err
\t}
\t_, err = file.Write(content)
\treturn err
}
\n
func (pool UserPool) DeleteUser(userPoolID UserPoolID, username Username) error {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\t
\tif _, exist := pool.getUser(userPoolID, username); exist {
\t\tdelete(pool.poolMap[userPoolID], username)
\t}
\treturn pool.updateFile()
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_user_pool.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

main 実行時にpool.json を読み込み、map で保持します。map にユーザーを追加、削除する度にファイルを更新しています。パフォーマンスは悪そうですが、そこまで気にしてないので良しとしています。

\n

ユーザー情報を拡張する場合は構造体のフィールドを追加するなどして対応できると思います。

\n

ルーティング

\n

公開鍵の取得以外は全て同じエンドポイントですが、リクエストの識別にはヘッダを使用しています。

\n

X-Amz-Target というキーにAWSCognitoIdentityProviderService.AdminInitiateAuth のような形式でセットされているので、これを使います。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"fmt"
\t"io/ioutil"
\t"log"
\t"net/http"
\t"strings"
\n
\t"github.com/go-chi/chi/v5"
\t"github.com/go-chi/render"
)
\n
func main() {
\t...
\tmux.Post("/", func(w http.ResponseWriter, r *http.Request) {
\t\tb, err := ioutil.ReadAll(r.Body)
\t\tif err != nil {
\t\t\trender.JSON(w, r, http.StatusInternalServerError)
\t\t\treturn
\t\t}
\t\tdefer r.Body.Close()
\n
\t\tout, err := route(r.Header.Get("X-Amz-Target"), b)
\t\tif err != nil {
\t\t\tlog.Println(err)
\t\t\trender.JSON(w, r, http.StatusInternalServerError)
\t\t\treturn
\t\t}
\t\tw.WriteHeader(http.StatusOK)
\t\tw.Write(out)
\t})
\n
\tlog.Println(http.ListenAndServe(":80", mux))
}
\n
func route(xAmzTarget string, body []byte) ([]byte, error) {
\ttargets := strings.Split(xAmzTarget, ".")
\tif len(targets) < 2 {
\t\treturn nil, fmt.Errorf("invalid header")
\t}
\n
\tswitch targets[1] {
\tcase "AdminInitiateAuth":
\t\treturn adminInitiateAuth(body)
\tcase "AdminCreateUser":
\t\treturn adminCreateUser(body)
\t...
\t}
\treturn nil, fmt.Errorf("invalid operation name")
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_route.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

認証

\n

公開鍵と同じように秘密鍵を読み込みます。clientID は環境変数から読み取ります。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"crypto/rsa"
\t"encoding/json"
\t"fmt"
\t"io/ioutil"
\t"log"
\t"time"
\n
\t"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
\t"github.com/dgrijalva/jwt-go"
)
\n
var signKey *rsa.PrivateKey
var clientID ClientID
\n
type ClientID string
\n
func main() {
\t...
\t
\t
\tsignKey, err = getPrivateKey()
\tif err != nil {
\t\tpanic(err)
\t}
\t
\tclientID = ClientID(os.Getenv("CLIENT_ID"))
\t
\t...
}
\n
func getPrivateKey() (*rsa.PrivateKey, error) {
\tsignBytes, err := ioutil.ReadFile("./key.pem")
\tif err != nil {
\t\treturn nil, err
\t}
\treturn jwt.ParseRSAPrivateKeyFromPEM(signBytes)
}
\n
func (u User) ToToken(userPoolID UserPoolID) *jwt.Token {
\ttoken := jwt.New(jwt.SigningMethodRS256)
\ttoken.Header["kid"] = jwkKeyID
\n
\tclaims := token.Claims.(jwt.MapClaims)
\tclaims["iat"] = time.Now().Unix()
\tclaims["exp"] = time.Now().Add(time.Hour * 24 * 365 * 10).Unix()
\tclaims["sub"] = u.UUID
\tclaims["email"] = u.Email
\treturn token
}
\n
func adminInitiateAuth(body []byte) ([]byte, error) {
\tin := cognitoidentityprovider.AdminInitiateAuthInput{}
\terr := json.Unmarshal(body, &in)
\tif err != nil {
\t\treturn nil, err
\t}
\t// TODO: まだ ADMIN_NO_SRP_AUTH だけ
\tif in.AuthFlow == nil || *in.AuthFlow != cognitoidentityprovider.AuthFlowTypeAdminNoSrpAuth {
\t\treturn nil, fmt.Errorf("invalid auth flow")
\t}
\n
\tvar cID ClientID
\tif in.ClientId != nil {
\t\tcID = ClientID(*in.ClientId)
\t}
\tif cID != clientID {
\t\treturn nil, fmt.Errorf("invalid client id")
\t}
\n
\tvar userPoolID UserPoolID
\tif in.UserPoolId != nil {
\t\tuserPoolID = UserPoolID(*in.UserPoolId)
\t}
\tvar username Username
\tif u, ok := in.AuthParameters["USERNAME"]; ok && u != nil {
\t\tusername = Username(*u)
\t}
\tu, ok := userPool.GetUser(
\t\tuserPoolID,
\t\tusername,
\t)
\tif !ok {
\t\treturn nil, fmt.Errorf("user not found")
\t}
\tif !u.EmailVerified {
\t\treturn nil, fmt.Errorf("email not verified")
\t}
\n
\tvar password string
\tif p, ok := in.AuthParameters["PASSWORD"]; ok && p != nil {
\t\tpassword = *p
\t}
\tif u.Password != password {
\t\treturn nil, fmt.Errorf("password not match")
\t}
\n
\ttokenString, err := u.ToToken(userPoolID).SignedString(signKey)
\tif err != nil {
\t\treturn nil, err
\t}
\treturn json.Marshal(cognitoidentityprovider.AdminInitiateAuthOutput{
\t\tAuthenticationResult: &cognitoidentityprovider.AuthenticationResultType{
\t\t\tAccessToken: &[]string{tokenString}[0],
\t\t},
\t})
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_admin_initiate_auth.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

requestBody はgithub.com/aws/aws-sdk-go/service/cognitoidentityprovider の構造体を使ってそのままパースできます。

\n

claims には最低限の情報をセットしていますが、実際に使うには足りないと思うので、以下を参考に必要に応じて情報を追加します。

\n
Using the ID Token - Amazon Cognito
Using the ID Token
Amazon Cognito

読み込んだ秘密鍵で署名し、トークン文字列に変換します。ここではAccessToken にセットしていますが、使い方によってはIdToken 等にセットするかもしれません。

\n

ユーザー作成

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
import (
\t"encoding/json"
\t"fmt"
\t"math/rand"
\n
\t"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
\t"github.com/gofrs/uuid"
)
\n
\n
func adminCreateUser(body []byte) ([]byte, error) {
\tin := cognitoidentityprovider.AdminCreateUserInput{}
\terr := json.Unmarshal(body, &in)
\tif err != nil {
\t\treturn nil, err
\t}
\n
\tvar userPoolID UserPoolID
\tif in.UserPoolId != nil {
\t\tuserPoolID = UserPoolID(*in.UserPoolId)
\t}
\tvar username Username
\tif in.Username != nil {
\t\tusername = Username(*in.Username)
\t}
\n
\tif in.MessageAction != nil && *in.MessageAction == "RESEND" {
\t\tif _, exist := userPool.GetUser(userPoolID, username); !exist {
\t\t\treturn nil, fmt.Errorf("user not found")
\t\t}
\t\t// TODO: パスワード変更して通知メール再送信
\t\treturn json.Marshal(cognitoidentityprovider.AdminCreateUserOutput{})
\t}
\n
\tvar email string
\tfor _, attr := range in.UserAttributes {
\t\tif attr.Name == nil || attr.Value == nil {
\t\t\tcontinue
\t\t}
\t\tif *attr.Name == "email" {
\t\t\temail = *attr.Value
\t\t}
\t}
\t// TODO: email_verified が true ならパスワードメール送信, false なら検証メール送信
\t// 常にtrueとして扱っている
\tif email == "" {
\t\treturn nil, fmt.Errorf("invalid email")
\t}
\n
\tid, err := uuid.NewV4()
\tif err != nil {
\t\treturn nil, err
\t}
\tpass, err := makeRandomStr(8)
\tif err != nil {
\t\treturn nil, err
\t}
\tidString := id.String()
\tuser := User{
\t\tUUID: idString,
\t\tPassword: pass,
\t\tUsername: username,
\t\tEmail: email,
\t\tEmailVerified: true,
\t}
\terr = userPool.CreateUser(userPoolID, user)
\tif err != nil {
\t\treturn nil, err
\t}
\n
\treturn json.Marshal(cognitoidentityprovider.AdminCreateUserOutput{
\t\tUser: &cognitoidentityprovider.UserType{
\t\t\tAttributes: []*cognitoidentityprovider.AttributeType{
\t\t\t\t{
\t\t\t\t\tName: &[]string{"sub"}[0],
\t\t\t\t\tValue: &[]string{idString}[0],
\t\t\t\t},
\t\t\t},
\t\t},
\t})
}
\n
func makeRandomStr(digit uint32) (string, error) {
\tconst letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@&%/:;,."
\n
\tb := make([]byte, digit)
\tif _, err := rand.Read(b); err != nil {
\t\treturn "", err
\t}
\n
\tvar result string
\tfor _, v := range b {
\t\tresult += string(letters[int(v)%len(letters)])
\t}
\treturn result, nil
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_admin_create_user.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n

全て検証済みのユーザーとして作成しています。メール送信部分は省いていますが、そのうち追加予定です。

\n

ランダム文字列生成は以下を参考にしました。

\n
golang でランダム文字列生成 - Qiita
Go では乱数を返すライブラリはあれど、ランダム文字列を返すライブラリがない（少なくとも今の所は）。というわけで、パスワードなどでランダムな文字列を生成したい場合は自分で書く必要がある。 ちなみに乱数を生成するには math/ra...
Qiitanakaryooo

アプリ側の設定

\n

Cognito のクライアント生成時に、特定の環境変数を設定している場合はそちらに繋ぐように変更します。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
\tvar endpoint *string
\tcognitoEndpoint = os.Getenv("COGNITO_ENDPOINT")
\tif cognitoEndpoint != "" {
\t\tendpoint = aws.String(cognitoEndpoint)
\t}
\tclient := cognitoidentityprovider.New(
\t\tsession.Must(session.NewSessionWithOptions(session.Options{
\t\t\tConfig: aws.Config{Endpoint: endpoint},
\t\t\tSharedConfigState: session.SharedConfigEnable,
\t\t})),
\t)
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_session_endpoint.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n
Configuring the AWS SDK for Go - AWS SDK for Go
Configure the |sdk-go| to specify which credentials to use and to which AWS Region to send requests.
AWS SDK for Go

まとめ

\n

すべてまとめると以下になります。コードが散らかってるのでもう少し整理したいところです…

\n

汎用的なものが作れたら Docker Hub に上げようかなと思っていましたが、中々難しそうです。

\n\n\n
\n
\n
\n
\n
\n \n
\n\n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
package main
\n
import (
\t"crypto/rsa"
\t"encoding/base64"
\t"encoding/binary"
\t"encoding/json"
\t"fmt"
\t"io/ioutil"
\t"log"
\t"math/rand"
\t"net/http"
\t"os"
\t"strings"
\t"sync"
\t"time"
\n
\t"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
\t"github.com/dgrijalva/jwt-go"
\t"github.com/go-chi/chi/v5"
\t"github.com/go-chi/chi/v5/middleware"
\t"github.com/go-chi/render"
\t"github.com/gofrs/uuid"
)
\n
var userPool UserPool
var clientID ClientID
var signKey *rsa.PrivateKey
\n
const jwkKeyID = "hoge"
const poolFileName = "pool.json"
\n
func main() {
\tdata, err := ioutil.ReadFile(poolFileName)
\tif err != nil {
\t\tpanic(err)
\t}
\tpoolMap := make(map[UserPoolID]UserMap)
\terr = json.Unmarshal(data, &poolMap)
\tif err != nil {
\t\tpanic(err)
\t}
\tuserPool = UserPool{
\t\tpoolMap: poolMap,
\t\tmutex: &sync.Mutex{},
\t}
\n
\tclientID = ClientID(os.Getenv("CLIENT_ID"))
\n
\tsignKey, err = getPrivateKey()
\tif err != nil {
\t\tpanic(err)
\t}
\n
\tpubKeyString, err := getPublicKey()
\tif err != nil {
\t\tpanic(err)
\t}
\n
\tmux := chi.NewRouter()
\tmux.Use(middleware.Logger)
\tmux.Get("/{userPoolID}/.well-known/jwks.json", func(w http.ResponseWriter, r *http.Request) {
\t\tw.Write([]byte(fmt.Sprintf(`{"keys":[%s]}`, pubKeyString)))
\t})
\tmux.Post("/", func(w http.ResponseWriter, r *http.Request) {
\t\tb, err := ioutil.ReadAll(r.Body)
\t\tif err != nil {
\t\t\trender.JSON(w, r, http.StatusInternalServerError)
\t\t\treturn
\t\t}
\t\tdefer r.Body.Close()
\n
\t\tout, err := route(r.Header.Get("X-Amz-Target"), b)
\t\tif err != nil {
\t\t\tlog.Println(err)
\t\t\trender.JSON(w, r, http.StatusInternalServerError)
\t\t\treturn
\t\t}
\t\tw.WriteHeader(http.StatusOK)
\t\tw.Write(out)
\t})
\n
\tlog.Println(http.ListenAndServe(":80", mux))
}
\n
type User struct {
\tUUID string `json:"uuid"`
\tPassword string `json:"password"`
\tUsername Username `json:"username"`
\tEmail string `json:"email"`
\tEmailVerified bool `json:"email_verified"`
}
\n
func (u User) ToToken(userPoolID UserPoolID) *jwt.Token {
\ttoken := jwt.New(jwt.SigningMethodRS256)
\ttoken.Header["kid"] = jwkKeyID
\n
\tclaims := token.Claims.(jwt.MapClaims)
\tclaims["iat"] = time.Now().Unix()
\tclaims["exp"] = time.Now().Add(time.Hour * 24 * 365 * 10).Unix()
\tclaims["sub"] = u.UUID
\tclaims["email"] = u.Email
\treturn token
}
\n
type ClientID string
\n
type Username string
\n
type UserMap map[Username]*User
\n
type UserPoolID string
\n
type UserPool struct {
\tpoolMap map[UserPoolID]UserMap
\tmutex *sync.Mutex
}
\n
func (pool UserPool) GetUser(userPoolID UserPoolID, username Username) (*User, bool) {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\treturn pool.getUser(userPoolID, username)
}
\n
func (pool UserPool) getUser(userPoolID UserPoolID, username Username) (*User, bool) {
\tuMap, ok := pool.poolMap[userPoolID]
\tif !ok {
\t\treturn nil, false
\t}
\tu, ok := uMap[username]
\tif !ok {
\t\treturn nil, false
\t}
\treturn u, true
}
\n
func (pool UserPool) CreateUser(userPoolID UserPoolID, user User) error {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\n
\tuMap, ok := pool.poolMap[userPoolID]
\tif !ok {
\t\tuMap = make(UserMap)
\t\tpool.poolMap[userPoolID] = uMap
\t}
\tif _, ok := uMap[user.Username]; ok {
\t\treturn fmt.Errorf("already exist")
\t}
\tuMap[user.Username] = &user
\treturn pool.updateFile()
}
\n
func (pool UserPool) updateFile() error {
\tfile, err := os.Create(poolFileName)
\tif err != nil {
\t\treturn err
\t}
\tdefer file.Close()
\tcontent, err := json.Marshal(pool.poolMap)
\tif err != nil {
\t\treturn err
\t}
\t_, err = file.Write(content)
\treturn err
}
\n
func (pool UserPool) DeleteUser(userPoolID UserPoolID, username Username) error {
\tpool.mutex.Lock()
\tdefer pool.mutex.Unlock()
\n
\tif _, exist := pool.getUser(userPoolID, username); exist {
\t\tdelete(pool.poolMap[userPoolID], username)
\t}
\treturn pool.updateFile()
}
\n
type jwkKey struct {
\tAlg string `json:"alg"`
\tE string `json:"e"`
\tKid string `json:"kid"`
\tKty string `json:"kty"`
\tN string `json:"n"`
\tUse string `json:"use"`
}
\n
func getPublicKey() (string, error) {
\tverifyBytes, err := ioutil.ReadFile("./key.pem.pub.pkcs8")
\tif err != nil {
\t\treturn "", err
\t}
\tverifyKey, err := jwt.ParseRSAPublicKeyFromPEM(verifyBytes)
\tif err != nil {
\t\treturn "", err
\t}
\n
\tencodedN := base64.RawURLEncoding.EncodeToString(verifyKey.N.Bytes())
\n
\tbytesE := make([]byte, 4)
\tbinary.BigEndian.PutUint32(bytesE, uint32(verifyKey.E))
\n
\tencodedE := base64.RawURLEncoding.EncodeToString(bytesE)
\n
\tpubKey, err := json.Marshal(jwkKey{
\t\tAlg: jwt.SigningMethodRS256.Alg(),
\t\tE: encodedE,
\t\tKid: jwkKeyID,
\t\tKty: "RSA",
\t\tN: encodedN,
\t\tUse: "sig",
\t})
\tif err != nil {
\t\treturn "", err
\t}
\treturn string(pubKey), nil
}
\n
func getPrivateKey() (*rsa.PrivateKey, error) {
\tsignBytes, err := ioutil.ReadFile("./key.pem")
\tif err != nil {
\t\treturn nil, err
\t}
\treturn jwt.ParseRSAPrivateKeyFromPEM(signBytes)
}
\n
func route(xAmzTarget string, body []byte) ([]byte, error) {
\tlog.Println(xAmzTarget)
\ttargets := strings.Split(xAmzTarget, ".")
\tif len(targets) < 2 {
\t\treturn nil, fmt.Errorf("invalid header")
\t}
\n
\tswitch targets[1] {
\tcase "AdminInitiateAuth":
\t\treturn adminInitiateAuth(body)
\tcase "AdminCreateUser":
\t\treturn adminCreateUser(body)
\t}
\treturn nil, fmt.Errorf("invalid operation name")
}
\n
func adminInitiateAuth(body []byte) ([]byte, error) {
\tin := cognitoidentityprovider.AdminInitiateAuthInput{}
\terr := json.Unmarshal(body, &in)
\tif err != nil {
\t\treturn nil, err
\t}
\t// TODO: まだ ADMIN_NO_SRP_AUTH だけ
\tif in.AuthFlow == nil || *in.AuthFlow != cognitoidentityprovider.AuthFlowTypeAdminNoSrpAuth {
\t\treturn nil, fmt.Errorf("invalid auth flow")
\t}
\n
\tvar cID ClientID
\tif in.ClientId != nil {
\t\tcID = ClientID(*in.ClientId)
\t}
\tif cID != clientID {
\t\treturn nil, fmt.Errorf("invalid client id")
\t}
\n
\tvar userPoolID UserPoolID
\tif in.UserPoolId != nil {
\t\tuserPoolID = UserPoolID(*in.UserPoolId)
\t}
\tvar username Username
\tif u, ok := in.AuthParameters["USERNAME"]; ok && u != nil {
\t\tusername = Username(*u)
\t}
\tu, ok := userPool.GetUser(
\t\tuserPoolID,
\t\tusername,
\t)
\tif !ok {
\t\treturn nil, fmt.Errorf("user not found")
\t}
\tif !u.EmailVerified {
\t\treturn nil, fmt.Errorf("email not verified")
\t}
\n
\tvar password string
\tif p, ok := in.AuthParameters["PASSWORD"]; ok && p != nil {
\t\tpassword = *p
\t}
\tif u.Password != password {
\t\treturn nil, fmt.Errorf("password not match")
\t}
\n
\ttokenString, err := u.ToToken(userPoolID).SignedString(signKey)
\tif err != nil {
\t\treturn nil, err
\t}
\treturn json.Marshal(cognitoidentityprovider.AdminInitiateAuthOutput{
\t\tAuthenticationResult: &cognitoidentityprovider.AuthenticationResultType{
\t\t\tAccessToken: &[]string{tokenString}[0],
\t\t},
\t})
}
\n
func adminCreateUser(body []byte) ([]byte, error) {
\tin := cognitoidentityprovider.AdminCreateUserInput{}
\terr := json.Unmarshal(body, &in)
\tif err != nil {
\t\treturn nil, err
\t}
\n
\tvar userPoolID UserPoolID
\tif in.UserPoolId != nil {
\t\tuserPoolID = UserPoolID(*in.UserPoolId)
\t}
\tvar username Username
\tif in.Username != nil {
\t\tusername = Username(*in.Username)
\t}
\n
\tif in.MessageAction != nil && *in.MessageAction == "RESEND" {
\t\tif _, exist := userPool.GetUser(userPoolID, username); !exist {
\t\t\treturn nil, fmt.Errorf("user not found")
\t\t}
\t\t// TODO: パスワード変更して通知メール再送信
\t\treturn json.Marshal(cognitoidentityprovider.AdminCreateUserOutput{})
\t}
\n
\tvar email string
\tfor _, attr := range in.UserAttributes {
\t\tif attr.Name == nil || attr.Value == nil {
\t\t\tcontinue
\t\t}
\t\tif *attr.Name == "email" {
\t\t\temail = *attr.Value
\t\t}
\t}
\t// TODO: email_verified が true ならパスワードメール送信, false なら検証メール送信
\t// 常にtrueとして扱っている
\tif email == "" {
\t\treturn nil, fmt.Errorf("invalid email")
\t}
\n
\tid, err := uuid.NewV4()
\tif err != nil {
\t\treturn nil, err
\t}
\tpass, err := makeRandomStr(8)
\tif err != nil {
\t\treturn nil, err
\t}
\tidString := id.String()
\tuser := User{
\t\tUUID: idString,
\t\tPassword: pass,
\t\tUsername: username,
\t\tEmail: email,
\t\tEmailVerified: true,
\t}
\terr = userPool.CreateUser(userPoolID, user)
\tif err != nil {
\t\treturn nil, err
\t}
\n
\treturn json.Marshal(cognitoidentityprovider.AdminCreateUserOutput{
\t\tUser: &cognitoidentityprovider.UserType{
\t\t\tAttributes: []*cognitoidentityprovider.AttributeType{
\t\t\t\t{
\t\t\t\t\tName: &[]string{"sub"}[0],
\t\t\t\t\tValue: &[]string{idString}[0],
\t\t\t\t},
\t\t\t},
\t\t},
\t})
}
\n
func makeRandomStr(digit uint32) (string, error) {
\tconst letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@&%/:;,."
\n
\tb := make([]byte, digit)
\tif _, err := rand.Read(b); err != nil {
\t\treturn "", err
\t}
\n
\tvar result string
\tfor _, v := range b {
\t\tresult += string(letters[int(v)%len(letters)])
\t}
\treturn result, nil
}
\n\n\n
\n\n
\n
\n\n
\n
\n view raw\n cognito_mock.go\n hosted with ❤ by GitHub\n
\n
\n
\n\n","url":"https://ghost.tech.anti-pattern.co.jp/amazon-cognito-emulator/","canonical_url":null,"uuid":"db4d5d2c-4ac8-4437-bb81-71a55b004cb7","page":null,"codeinjection_foot":null,"codeinjection_head":null,"codeinjection_styles":null,"comment_id":"61040dc93986b000013a4604","reading_time":14}}]}},"pageContext":{"slug":"amazon-cognito","pageNumber":0,"humanPageNumber":1,"skip":0,"limit":12,"numberOfPages":1,"previousPagePath":"","nextPagePath":""}}, "staticQueryHashes": ["176528973","2358152166","2561578252","2731221146","4145280475"]}