Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CognitoでWebアプリケーション(not SPA)に ログインさせたい時、何を作らなくて...

CognitoでWebアプリケーション(not SPA)に ログインさせたい時、何を作らなくてはならないのか? / What do I create when I want to log in to a web application with Amazon Cognito?

Kitano Yuichi

July 14, 2023
Tweet

More Decks by Kitano Yuichi

Other Decks in Technology

Transcript

  1. Virtual private cloud (VPC) 8FCΞϓϦέʔγϣϯͷ"84ߏ੒ྫ 8 64&3 "VSPSB &MBTUJ$BDIF &$

    "-# $PHOJUP Ϣʔβʔϓʔϧ ೝূτʔΫϯ Public subnet Private subnet Private subnet ηογϣϯ%# ηογϣϯͰ ϢʔβʔΛࣝผ
  2. +85ͱݺ͹ΕΔܗࣜͰϢʔβʔ৘ใΛ͍࣋ͬͯ·͢ɻ { *%τʔΫϯͷಛ௃ 10 $PHOJUP Ϣʔβʔϓʔϧ *%τʔΫϯ ɹൿີݤ *%τʔΫϯൃߦ࣌ʹ ൿີ伴Ͱॺ໊

    ɹެ։ݤ w Ϣʔβʔ*%ʢTVCʣ w &NBJMʢFNBJMʣ w Ϣʔβʔϓʔϧ*%ʢJTTʣ w Ϣʔβʔ໊ 
 ʢDPHOJUPVTFSOBNFʣ w ༗ޮظݶʢFYQʣFUD *%τʔΫϯͷվ͟Μ͕ແ͍͔ ެ։伴ͰݕূՄೳ
  3. $PHOJUPͷೝূϑϩʔ 21 ೝূϑϩʔ໊ આ໌ "%.*/@64&3@1"44803%@"65) ʢچশɿ"%.*/@/0@431@"65)ʣ αʔόʔ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠ύεϫʔυΛૹͬͯೝূ͢Δೝূϑϩʔɻ ௨ৗΫϥΠΞϯτγʔΫϨοτΛ࢖༻͢Δɻ 64&3@431@"65) ΫϥΠΞϯτʢ41"౳ʣ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠431ϓϩτίϧͰύεϫ

    ʔυΛجʹͨ͠νϟϨϯδϨεϙϯεΛૹΓ͍͋ೝূ͢Δೝূϑϩʔɻ BNQMJGZKT͕σϑΥϧτͰ࢖༻͢Δɻ 64&3@1"44803%@"65) ΫϥΠΞϯτʢ41"౳ʣ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠ύεϫʔυΛૹͬͯೝূ͢ Δೝূϑϩʔɻ ΫϥΠΞϯτʢ41"౳ʣ͔Βͷ࣮ߦ͸643@431@"65)ͷར༻͕ਪ঑͞ΕΔɻ $6450.@"65) ೝূ࣌ʹ-BNCEBϑΝϯΫγϣϯ͕τϦΨʔ͞Εɺࣗ෼ͰೝূϑϩʔΛࣗ༝ʹ ઃఆͰ͖Δೝূϑϩʔɻ 3&'3&4)@50,&/@"65) ϦϑϨογϡτʔΫϯ͔Β৽͍͠τʔΫϯΛऔಘ͢Δೝূϑϩʔɻ
  4. "%.*/@64&3@1"44803%@"65)ϑϩʔ 24 &$ $PHOJUP Ϣʔβʔϓʔϧ "ENJO*OJUJBUF"VUI TFDSFU@IBTI#BTF )."$@4)" $PHOJUP ϢʔβʔϓʔϧͷγʔΫϨοτΩʔ

    ϩάΠϯϢʔβʔ໊  $PHOJUPϢʔβʔϓʔϧͷΫϥΠΞϯτ*%   DPHOJUPBENJO*OJUJBUF"VUI \ "VUI'MPXb"%.*/@64&3@1"44803%@"65)`  6TFS1PPM*E$PHOJUPϢʔβʔϓʔϧͷϢʔβʔϓʔϧ*%  $MJFOU*E$PHOJUPϢʔβʔϓʔϧͷΫϥΠΞϯτ*%  "VUI1BSBNFUFST\ 64&3/".&ϩάΠϯϢʔβʔ໊  1"44803%ύεϫʔυ  4&$3&5@)"4)TFDSFU@IBTI  ^  ^ \ "VUIFOUJDBUJPO3FTVMU\ "DDFTT5PLFOʜ  &YQJSFT*Oʜ  5PLFO5ZQFb#FBSFS`  3FGSFTI5PLFOʜ  *E5PLFOʜ  ^  ʜ  ^ ֤छτʔΫϯ
  5. ۩ମతͳ4&$3&5@)"4)ͷܭࢉํ๏ QZUIPO 25 import hmac, hashlib, base64 def create_secret_hash(user_name, app_client_id,

    secret_key): message = bytes(user_name + app_client_id, ‘utf-8’) key = bytes(secret_key, ‘utf-8’) digest = hmac.new(key, message, digestmod=hashlib.sha256).digest() secret_hash = base64.b64encode(digest).decode() return secret_hash user_name = <<ϩάΠϯϢʔβʔ໊>> app_client_id = <<CgonitoϢʔβʔϓʔϧͷΫϥΠΞϯτID>> secret_key = <<CognitoϢʔβʔϓʔϧͷΫϥΠΞϯτγʔΫϨοτ>> print('SECRET HASH:’,create_secret_hash(user_name, app_client_id, secret_key)) ʲࢀߟʳϢʔβʔΞΧ΢ϯτͷαΠϯΞοϓͱ֬ೝγʔΫϨοτϋογϡ஋ͷܭࢉ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFTJHOJOHVQVTFSTJOZPVSBQQIUNM
  6. )PTUFE6*ͷϝϦοτɾσϝϦοτ ϝϦοτ w ϩάΠϯը໘Λ࡞Βͳͯ͘ྑ͍ w αΠϯΞοϓը໘ɺύεϫʔυΛ͓๨ΕͰ͔͢ʁը໘΋͋Δ w ֎෦*E1͕࢖͑Δ σϝϦοτ w

    ϩάΠϯը໘ͷ೔ຊޠԽ΍σβΠϯͷΧελϚΠζʹ੍ݶ͕͋Δ w ࣗલͰ࡞Δʹ͸ೝূϑϩʔ͕ෳࡶͰେม 27
  7. $PHOJUPͷ0"VUIϑϩʔ )PTUFE6*Λར༻͢Δ৔߹ɺ0"VUIϑϩʔͰτʔΫϯΛ औಘ͢Δ͜ͱʹͳΓ·͢ɻ 29 0"VUIϑϩʔ໊ આ໌ "VUIPSJ[BUJPODPEFHSBOU ʢೝূίʔυͷ෇༩ʣ جຊతʹ࢖༻͕ਪ঑͞ΕΔϑϩʔɻ $PHOJUPͰαʔόʔΛ஥հͯ͠τʔΫϯΛऔಘ͢Δ৔߹͸ɺ௨ৗΫϥΠΞϯ

    τγʔΫϨοτΛઃఆͯ͠ར༻͢Δɻ 41"ͷΑ͏ʹϢʔβʔ͕τʔΫϯΛ௚઀औಘ͢Δ৔߹͸1,$&Λซ༻͢Δ͜ ͱ͕ਪ঑͞ΕΔɻ *NQMJDJUHSBOU ʢ҉໧ͷ෇༩ʣ "VUIPSJ[BUJPODPEFHSBOUͷ࢖༻͕ෆՄೳͳ৔߹બ୒͢Δɻ 
 "VUIPSJ[BUJPODPEFHSBOUͷ࢖༻͕ਪ঑͞ΕΔɻ $MJFOUDSFEFOUJBMHSBOU ʢΫϥΠΞϯτೝূ৘ใʣ ϚγϯؒͷτʔΫϯަ׵͢Δࡍʹ࢖༻͢Δೝূϑϩʔɻ 
 ࠓճͷΑ͏ͳΤϯυϢʔβʔ͕ೝূʹ࢖͏ϑϩʔͰ͸ͳ͍ɻ
  8. ೝূϦΫΤετ 39 PBVUIBVUIPSJ[FʢೝՄΤϯυϙΠϯτʣʹରͯ͠ 
 ࣍ͷύϥϝʔλʔΛ(&5ϝιουͰૹ৴͠·͢ɻ ύϥϝʔλʔ໊ ࢦఆ͢Δ஋ SFTQPOTF@UZQF "VUIPSJ[BUJPODPEFHSBOUͷ৔߹ɿDPEFʢೝՄίʔυΛฦ͢ʣ *NQMJDJUHSBOUͷ৔߹ɿUPLFOʢτʔΫϯΛ௚઀ฦ͢ʣ

    DMJFOU@JE $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτ*% SFEJSFDU@VSJ ೝՄίʔυΛड͚औΔͨΊͷɺ 
 8FCΞϓϦͷϦμΠϨΫτઌ63-ʢྫɿIUUQTFYBNQMFDPNDBMMCBDLʣ TDPQF ೝূͰ*%τʔΫϯΛར༻͍ͨ͠৔߹ʮPQFOJEʯΛࢦఆ 
 ͦͷଞ߲໨ʹ͍ͭͯ͸ຊࢿྉͰ͸ׂѪ͠·͢ ʲࢀߟʳೝՄΤϯυϙΠϯτ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFBVUIPSJ[BUJPOFOEQPJOUIUNM
  9. τʔΫϯϦΫΤετ 42 PBVUIUPLFOʢτʔΫϯΤϯυϙΠϯτʣʹରͯ͠ 
 1045ϝιουͰૹ৴ͯ͠*%τʔΫϯΛऔಘ͠·͢ɻ ύϥϝʔλʔ໊ ࢦఆ͢Δ஋ HSBOU@UZQF "VUIPSJ[BUJPODPEFHSBOUͷ৔߹ɿBVUIPSJ[BUJPO@DPEF ϦϑϨογϡτʔΫϯͰͷ࠶औಘͷ৔߹ɿSFGSFTI@UPLFO

    $MJFOUDSFEFOUJBMHSBOUͷ৔߹ɿDMJFOU@DSFEFOUJBMT DMJFOU@JE $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτ*% DMJFOU@TFDSFU $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτγʔΫϨοτ SFEJSFDU@VSJ ೝՄΤϯυϙΠϯτͰ࢖༻ͨ͠΋ͷͱಉ͡SFEJSFDU@VSJΛࢦఆ ʢྫɿIUUQTFYBNQMFDPNDBMMCBDLʣ DPEF ΫΤϦύϥϝʔλʔͰड͚औͬͨೝՄίʔυ ʲࢀߟʳτʔΫϯΤϯυϙΠϯτ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFUPLFOFOEQPJOUIUNM
  10. ·ͱΊ 53 w $PHOJUPΛ8FCΞϓϦέʔγϣϯͷೝূͰ࢖͏ʹ͸ w "844%,ɼ)PTUFE6*ͱ̎छྨͷϩάΠϯํ๏͕͋Γ·͢ w ϩάΠϯํ๏ʹ͋ΘͤͨೝূϑϩʔΛཧղ্ͨ͠Ͱͷ࣮૷͕ඞ ཁͰ͢ w

    (PPHMFϩάΠϯ౳ɺ֎෦*E1Λ࢖͍͍ͨ৔߹͸ɺ 
 )PTUFE6*Λར༻͢Δೝূϑϩʔͷ࣮૷͕ඞཁͰ͢ɻ 
 ࢖ͬͯͳ͍Α͏ʹݟ͑ͯ΋࢖͍ͬͯ·͢ɻ