Ios Can'；t使用开发者身份验证Swift Cognito承担身份验证角色

我可以成功地从LambdAuth（我的开发人员身份验证）检索令牌和标识，但当我尝试使用服务时，Cognoto承担未经身份验证的角色。这是我的错误：

Error-Domain=com.amazonaws.awsdynamodErrordomain-code=1“（null）”UserInfo={Message=User:arn:aws:sts:：xxxxxxxxx:acked-role/Cognito\u LambdAuthUnauth\u-role/CognitoIdentityCredentials未被授权执行：dynamodb:ListTables on-on-on-resource:*，\uu-type=com.amazon.coral.service\AccessDeniedException}

我希望这个角色是CognitoLambdAuthAuth_的角色

这是我的身份提供者代码：

//  MyIdentityProvider.swift

import Foundation
import AWSCore
import AWSCognito
import AWSLambda

class MyIdentityProvider: AWSAbstractCognitoIdentityProvider {
    var _token: String!
    var _logins: [ NSObject : AnyObject ]!

    var email: String!
    var password: String!

    override var token: String {
        get {
            return _token
        }
    }

    override var logins: [ NSObject : AnyObject ]! {
        get {
            return _logins
        }
        set {
            _logins = newValue
        }
    }

    override func getIdentityId() -> AWSTask! {

        if self.identityId != nil {
            return AWSTask(result: self.identityId)
        }else{
            return AWSTask(result: nil).continueWithBlock({ (task) -> AnyObject! in
                if self.identityId == nil {
                    return self.refresh()
                }
                return AWSTask(result: self.identityId)
            })
        }
    }

    override func refresh() -> AWSTask! {

        let invocationRequest = AWSLambdaInvokerInvocationRequest()
        invocationRequest.functionName = "LambdAuthLogin"
        invocationRequest.invocationType = AWSLambdaInvocationType.RequestResponse
        invocationRequest.payload = ["email" : "me@example.com", "password" : "password"]

        //self.activeSearchRequest = invocationRequest

        let lambdaInvoker = AWSLambdaInvoker.defaultLambdaInvoker()
        let task = lambdaInvoker.invoke(invocationRequest).continueWithSuccessBlock() { (task) -> AWSTask! in
            if (task.error != nil) {
                // failed to retrieve token.
                print("Error invoking lambda function: ", task.error)
            } else {
                //print("response: ", task.result)
                if let payload = task.result.payload as? [String: AnyObject] {
                    if(payload["login"] as! Int == 1) {
                        // The following 3 lines are required as referenced here: http://stackoverflow.com/a/26741208/535363
                        var tmp = NSMutableDictionary()
                        tmp.setObject(self.email, forKey: "cognito-identity.amazonaws.com")
                        self.logins = tmp as [NSObject : AnyObject]

                        self.identityId = payload["identityId"] as! String
                        self._token = payload["token"] as! String

                    }
                    print("id", payload["identityId"])
                    print("token: ", payload["token"])
                    print("logins map", self.logins)
                }
            }
            return task
        }
        return task            
    }
}

下面是我调用生成错误的DynamoDB调用的地方：

let dynamoDB = AWSDynamoDB.defaultDynamoDB()
let listTableInput = AWSDynamoDBListTablesInput()
print("listing dynamoDB tables..")
let finalTask = dynamoDB.listTables(listTableInput).continueWithBlock{ (task: AWSTask!) -> AnyObject! in
    if (task.error != nil) {
        // failed to retrieve identityId.
        if let handler = completionHandler {
            print("Store Data Error occurred: \(task.error)")
            handler(false)
        }
        return task
    } else {
        print("Store Data Succeeded...")
        let listTablesOutput = task.result as! AWSDynamoDBListTablesOutput

        for tableName : AnyObject in listTablesOutput.tableNames {
            print("\(tableName)")
        }
        if let handler = completionHandler {
            handler(true)
        }
        return task
    }
}

以及在DynamoDB调用之前检索标识的代码：

    func getAuthCognitoId(email: String, password: String, identityProvider: MyIdentityProvider)->AWSTask! {
        identityProvider.email = email
        identityProvider.password = password
        // TODO: Store to a keychain

        let task = identityProvider.getIdentityId().continueWithSuccessBlock() { (task) -> AWSTask! in

            let credentialsProvider = AWSCognitoCredentialsProvider(regionType: AWSRegionType.USEast1, identityProvider: identityProvider, unauthRoleArn: Constants.ARNUnauth.value, authRoleArn: Constants.ARNAuth.value)
            let defaultServiceConfiguration = AWSServiceConfiguration(region: .USEast1, credentialsProvider: credentialsProvider)
            AWSServiceManager.defaultServiceManager().defaultServiceConfiguration = defaultServiceConfiguration
            return task
        }
        return task
    }

编辑2015年8月12日：

我在lambda函数前面添加了API网关，但仍然无法获得授权角色。它成功地检索了令牌和idenityId，但是：

override func refresh() -> AWSTask! {

    let task = AWSTaskCompletionSource()
    let request = AFHTTPRequestOperationManager()
    request.requestSerializer.setValue(email, forHTTPHeaderField: "email")
    request.requestSerializer.setValue(password, forHTTPHeaderField: "password")
    request.GET(Constants.loginUrl.value, parameters: nil, success: { (request: AFHTTPRequestOperation!, response: AnyObject!) -> Void in
        print("request: ", request)
        // The following 3 lines are required as referenced here: http://stackoverflow.com/a/26741208/535363
        self.logins = [self.developerProvider: self.email]

        // Get the properties from my server response
        print("response: ", response)
        let identityId = response.objectForKey("identityId")as! String
        let token = response.objectForKey("token")as! String

        // Set the identityId and token for the ExampleAppIdentityProvider
        self.identityId = identityId
        self._token = token

        task.setResult(self.identityId)
        }, failure: { (request: AFHTTPRequestOperation?, error: NSError!) -> Void in
            task.setError(error)
    })
    return task.task
}

---

问题是您正在使用未经授权的凭据调用lambda

let lambdaInvoker = AWSLambdaInvoker.defaultLambdaInvoker()

---

由于它将这些凭据存储在密钥链中以供后续请求使用，并且仅在它们过期时刷新它们，因此在调用DDB时仍使用未经验证的凭据。尝试使用api网关前置lambda auth，这样您就不必像您的评论中提到的那样开始使用未经授权的凭据，如果您仍然存在问题，请告诉我。

看来我必须将lambda函数置于api网关之后，我会确认它是否正常工作：那么你使用Lambda来创建注册或登录到你的ios应用程序，而不是cognito，还是两者都使用？@Lamar cognito与使用Lambda构建的开发人员身份验证一起使用。我已经使用API网关来代替Lambda，但仍然无法获得经过身份验证的身份。我正在尝试查看是否需要执行credentialsProvider.refresh（）per仍然不走运。它不会更改为已验证角色。我已经将其设置为在另一个平台上使用javascript，因此后端代码很好，并且设置了Cognito角色。需要检查的两件事：Constants.ARNAuth.value设置是否正确？在调用APIGateway和Dynamo之前，您是否调用了任何其他AWS服务？没有明确说明，在调试中调用DynamoDB之前，是否有方法检查AWS是否为我分配了一个标识？与AWSServiceConfiguration对象一样，您是否具有标识并不重要，更重要的是与该标识关联的凭据。如果您有凭据，则应该能够从凭据提供程序对象获取accessKey/secretKey。您是否确认Constants.ARNAuth.value未设置为您的未授权角色arn？