-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement login, logout and related authentication elements. #2
Comments
I've been trying to set up authentication to AWS Cognito using the Java v2 SDK. My two options seem to be USER_SRP_AUTH (no password is sent, but a complex hash is generated and sent, challenged and authenticated), or USER_PASSWORD_AUTH (a simpler user/password setup). Unfortunately AWS are not providing samples or an API in Java for USER_SRP_AUTH (see aws/aws-sdk-java-v2#2851 ). And AWS CDK does not allow me to create a USER_PASSWORD_AUTH flow for an app client, presumably because it's insecure. I thought auth was going to be easier than UI... (The web front end uses ALLOW_REFRESH_TOKEN_AUTH I think). Can I use that on the desktop? How would it redirect to cognito to get the token? |
Possible partial implementation here: https://github.com/secure-remote-password/stanford-srp/blob/master/java/1.1.x/security/srp/SRPClient.java But both are predicated on me having registered using SRP - and I don't think I have. There is the insecure ADMIN_USER_PASSWORD_AUTH route but that's only supposed to be used on secured servers, not clients. |
Replicating the web experience in the desktop:
https://www.oauth.com/oauth2-servers/oauth-native-apps/redirect-urls-for-native-apps/ |
Though I had some of this behaviour happening - the app would launch a web browser at the Cognito auth URL, and the app ran a web server which would respond to the callback URL - I can't see how I'd make this sequential, how to make the app wait for the auth code from the callback URL. My only remaining thought is to return to the AWS SDK and use the ADMIN_USER_PASSWORD_AUTH mechanism. I would need to give the Corbel app access to my AWS secret key - which is stored in an environment variable, so is do-able. |
This is now working, without needing to fall back to the ADMIN route. The user clicks Login, and is directed to the Cognito hosted UI. This returns an auth code, which Corbel captures through an embedded ktor server listening on localhost. |
Use the AWS Cognito API to authenticate and log in with the username and password provided.
The text was updated successfully, but these errors were encountered: