Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CognitoでWebアプリケーション(not SPA)に ログインさせたい時、何を作らなくて...

CognitoでWebアプリケーション(not SPA)に ログインさせたい時、何を作らなくてはならないのか? / What do I create when I want to log in to a web application with Amazon Cognito?

Avatar for Kitano Yuichi

Kitano Yuichi

July 14, 2023
Tweet

More Decks by Kitano Yuichi

Other Decks in Technology

Transcript

  1. Virtual private cloud (VPC) 8FCΞϓϦέʔγϣϯͷ"84ߏ੒ྫ 8 64&3 "VSPSB &MBTUJ$BDIF &$

    "-# $PHOJUP Ϣʔβʔϓʔϧ ೝূτʔΫϯ Public subnet Private subnet Private subnet ηογϣϯ%# ηογϣϯͰ ϢʔβʔΛࣝผ
  2. +85ͱݺ͹ΕΔܗࣜͰϢʔβʔ৘ใΛ͍࣋ͬͯ·͢ɻ { *%τʔΫϯͷಛ௃ 10 $PHOJUP Ϣʔβʔϓʔϧ *%τʔΫϯ ɹൿີݤ *%τʔΫϯൃߦ࣌ʹ ൿີ伴Ͱॺ໊

    ɹެ։ݤ w Ϣʔβʔ*%ʢTVCʣ w &NBJMʢFNBJMʣ w Ϣʔβʔϓʔϧ*%ʢJTTʣ w Ϣʔβʔ໊ 
 ʢDPHOJUPVTFSOBNFʣ w ༗ޮظݶʢFYQʣFUD *%τʔΫϯͷվ͟Μ͕ແ͍͔ ެ։伴ͰݕূՄೳ
  3. $PHOJUPͷೝূϑϩʔ 21 ೝূϑϩʔ໊ આ໌ "%.*/@64&3@1"44803%@"65) ʢچশɿ"%.*/@/0@431@"65)ʣ αʔόʔ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠ύεϫʔυΛૹͬͯೝূ͢Δೝূϑϩʔɻ ௨ৗΫϥΠΞϯτγʔΫϨοτΛ࢖༻͢Δɻ 64&3@431@"65) ΫϥΠΞϯτʢ41"౳ʣ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠431ϓϩτίϧͰύεϫ

    ʔυΛجʹͨ͠νϟϨϯδϨεϙϯεΛૹΓ͍͋ೝূ͢Δೝূϑϩʔɻ BNQMJGZKT͕σϑΥϧτͰ࢖༻͢Δɻ 64&3@1"44803%@"65) ΫϥΠΞϯτʢ41"౳ʣ͔Β࣮ߦ͢Δ͜ͱΛ૝ఆͨ͠ύεϫʔυΛૹͬͯೝূ͢ Δೝূϑϩʔɻ ΫϥΠΞϯτʢ41"౳ʣ͔Βͷ࣮ߦ͸643@431@"65)ͷར༻͕ਪ঑͞ΕΔɻ $6450.@"65) ೝূ࣌ʹ-BNCEBϑΝϯΫγϣϯ͕τϦΨʔ͞Εɺࣗ෼ͰೝূϑϩʔΛࣗ༝ʹ ઃఆͰ͖Δೝূϑϩʔɻ 3&'3&4)@50,&/@"65) ϦϑϨογϡτʔΫϯ͔Β৽͍͠τʔΫϯΛऔಘ͢Δೝূϑϩʔɻ
  4. "%.*/@64&3@1"44803%@"65)ϑϩʔ 24 &$ $PHOJUP Ϣʔβʔϓʔϧ "ENJO*OJUJBUF"VUI TFDSFU@IBTI#BTF )."$@4)" $PHOJUP ϢʔβʔϓʔϧͷγʔΫϨοτΩʔ

    ϩάΠϯϢʔβʔ໊  $PHOJUPϢʔβʔϓʔϧͷΫϥΠΞϯτ*%   DPHOJUPBENJO*OJUJBUF"VUI \ "VUI'MPXb"%.*/@64&3@1"44803%@"65)`  6TFS1PPM*E$PHOJUPϢʔβʔϓʔϧͷϢʔβʔϓʔϧ*%  $MJFOU*E$PHOJUPϢʔβʔϓʔϧͷΫϥΠΞϯτ*%  "VUI1BSBNFUFST\ 64&3/".&ϩάΠϯϢʔβʔ໊  1"44803%ύεϫʔυ  4&$3&5@)"4)TFDSFU@IBTI  ^  ^ \ "VUIFOUJDBUJPO3FTVMU\ "DDFTT5PLFOʜ  &YQJSFT*Oʜ  5PLFO5ZQFb#FBSFS`  3FGSFTI5PLFOʜ  *E5PLFOʜ  ^  ʜ  ^ ֤छτʔΫϯ
  5. ۩ମతͳ4&$3&5@)"4)ͷܭࢉํ๏ QZUIPO 25 import hmac, hashlib, base64 def create_secret_hash(user_name, app_client_id,

    secret_key): message = bytes(user_name + app_client_id, ‘utf-8’) key = bytes(secret_key, ‘utf-8’) digest = hmac.new(key, message, digestmod=hashlib.sha256).digest() secret_hash = base64.b64encode(digest).decode() return secret_hash user_name = <<ϩάΠϯϢʔβʔ໊>> app_client_id = <<CgonitoϢʔβʔϓʔϧͷΫϥΠΞϯτID>> secret_key = <<CognitoϢʔβʔϓʔϧͷΫϥΠΞϯτγʔΫϨοτ>> print('SECRET HASH:’,create_secret_hash(user_name, app_client_id, secret_key)) ʲࢀߟʳϢʔβʔΞΧ΢ϯτͷαΠϯΞοϓͱ֬ೝγʔΫϨοτϋογϡ஋ͷܭࢉ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFTJHOJOHVQVTFSTJOZPVSBQQIUNM
  6. )PTUFE6*ͷϝϦοτɾσϝϦοτ ϝϦοτ w ϩάΠϯը໘Λ࡞Βͳͯ͘ྑ͍ w αΠϯΞοϓը໘ɺύεϫʔυΛ͓๨ΕͰ͔͢ʁը໘΋͋Δ w ֎෦*E1͕࢖͑Δ σϝϦοτ w

    ϩάΠϯը໘ͷ೔ຊޠԽ΍σβΠϯͷΧελϚΠζʹ੍ݶ͕͋Δ w ࣗલͰ࡞Δʹ͸ೝূϑϩʔ͕ෳࡶͰେม 27
  7. $PHOJUPͷ0"VUIϑϩʔ )PTUFE6*Λར༻͢Δ৔߹ɺ0"VUIϑϩʔͰτʔΫϯΛ औಘ͢Δ͜ͱʹͳΓ·͢ɻ 29 0"VUIϑϩʔ໊ આ໌ "VUIPSJ[BUJPODPEFHSBOU ʢೝূίʔυͷ෇༩ʣ جຊతʹ࢖༻͕ਪ঑͞ΕΔϑϩʔɻ $PHOJUPͰαʔόʔΛ஥հͯ͠τʔΫϯΛऔಘ͢Δ৔߹͸ɺ௨ৗΫϥΠΞϯ

    τγʔΫϨοτΛઃఆͯ͠ར༻͢Δɻ 41"ͷΑ͏ʹϢʔβʔ͕τʔΫϯΛ௚઀औಘ͢Δ৔߹͸1,$&Λซ༻͢Δ͜ ͱ͕ਪ঑͞ΕΔɻ *NQMJDJUHSBOU ʢ҉໧ͷ෇༩ʣ "VUIPSJ[BUJPODPEFHSBOUͷ࢖༻͕ෆՄೳͳ৔߹બ୒͢Δɻ 
 "VUIPSJ[BUJPODPEFHSBOUͷ࢖༻͕ਪ঑͞ΕΔɻ $MJFOUDSFEFOUJBMHSBOU ʢΫϥΠΞϯτೝূ৘ใʣ ϚγϯؒͷτʔΫϯަ׵͢Δࡍʹ࢖༻͢Δೝূϑϩʔɻ 
 ࠓճͷΑ͏ͳΤϯυϢʔβʔ͕ೝূʹ࢖͏ϑϩʔͰ͸ͳ͍ɻ
  8. ೝূϦΫΤετ 39 PBVUIBVUIPSJ[FʢೝՄΤϯυϙΠϯτʣʹରͯ͠ 
 ࣍ͷύϥϝʔλʔΛ(&5ϝιουͰૹ৴͠·͢ɻ ύϥϝʔλʔ໊ ࢦఆ͢Δ஋ SFTQPOTF@UZQF "VUIPSJ[BUJPODPEFHSBOUͷ৔߹ɿDPEFʢೝՄίʔυΛฦ͢ʣ *NQMJDJUHSBOUͷ৔߹ɿUPLFOʢτʔΫϯΛ௚઀ฦ͢ʣ

    DMJFOU@JE $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτ*% SFEJSFDU@VSJ ೝՄίʔυΛड͚औΔͨΊͷɺ 
 8FCΞϓϦͷϦμΠϨΫτઌ63-ʢྫɿIUUQTFYBNQMFDPNDBMMCBDLʣ TDPQF ೝূͰ*%τʔΫϯΛར༻͍ͨ͠৔߹ʮPQFOJEʯΛࢦఆ 
 ͦͷଞ߲໨ʹ͍ͭͯ͸ຊࢿྉͰ͸ׂѪ͠·͢ ʲࢀߟʳೝՄΤϯυϙΠϯτ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFBVUIPSJ[BUJPOFOEQPJOUIUNM
  9. τʔΫϯϦΫΤετ 42 PBVUIUPLFOʢτʔΫϯΤϯυϙΠϯτʣʹରͯ͠ 
 1045ϝιουͰૹ৴ͯ͠*%τʔΫϯΛऔಘ͠·͢ɻ ύϥϝʔλʔ໊ ࢦఆ͢Δ஋ HSBOU@UZQF "VUIPSJ[BUJPODPEFHSBOUͷ৔߹ɿBVUIPSJ[BUJPO@DPEF ϦϑϨογϡτʔΫϯͰͷ࠶औಘͷ৔߹ɿSFGSFTI@UPLFO

    $MJFOUDSFEFOUJBMHSBOUͷ৔߹ɿDMJFOU@DSFEFOUJBMT DMJFOU@JE $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτ*% DMJFOU@TFDSFU $PHOJUPϢʔβʔϓʔϧͷΞϓϦέʔγϣϯΫϥΠΞϯτγʔΫϨοτ SFEJSFDU@VSJ ೝՄΤϯυϙΠϯτͰ࢖༻ͨ͠΋ͷͱಉ͡SFEJSFDU@VSJΛࢦఆ ʢྫɿIUUQTFYBNQMFDPNDBMMCBDLʣ DPEF ΫΤϦύϥϝʔλʔͰड͚औͬͨೝՄίʔυ ʲࢀߟʳτʔΫϯΤϯυϙΠϯτ"NB[PO$PHOJUP IUUQTEPDTBXTBNB[PODPNKB@KQDPHOJUPMBUFTUEFWFMPQFSHVJEFUPLFOFOEQPJOUIUNM
  10. ·ͱΊ 53 w $PHOJUPΛ8FCΞϓϦέʔγϣϯͷೝূͰ࢖͏ʹ͸ w "844%,ɼ)PTUFE6*ͱ̎छྨͷϩάΠϯํ๏͕͋Γ·͢ w ϩάΠϯํ๏ʹ͋ΘͤͨೝূϑϩʔΛཧղ্ͨ͠Ͱͷ࣮૷͕ඞ ཁͰ͢ w

    (PPHMFϩάΠϯ౳ɺ֎෦*E1Λ࢖͍͍ͨ৔߹͸ɺ 
 )PTUFE6*Λར༻͢Δೝূϑϩʔͷ࣮૷͕ඞཁͰ͢ɻ 
 ࢖ͬͯͳ͍Α͏ʹݟ͑ͯ΋࢖͍ͬͯ·͢ɻ