在Cognito中使用Spring Security获取自定义属性

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>cognitoidentityprovider</artifactId>
</dependency>

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import software.amazon.awssdk.services.cognitoidentityprovider.CognitoIdentityProviderClient;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AdminGetUserRequest;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AdminGetUserResponse;
import software.amazon.awssdk.services.cognitoidentityprovider.model.AttributeType;

@Service
public class CognitoUserService implements UserDetailsService {

    @Autowired
    private CognitoIdentityProviderClient cognitoClient;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        AdminGetUserRequest request = AdminGetUserRequest.builder()
                .userPoolId("your-user-pool-id")
                .username(username)
                .build();

        AdminGetUserResponse response = cognitoClient.adminGetUser(request);

        // 获取自定义属性
        List<AttributeType> attributes = response.userAttributes();
        for (AttributeType attribute : attributes) {
            if (attribute.name().equals("customAttribute")) {
                // 在这里可以获取自定义属性的值，并进行相应的处理
                String customAttributeValue = attribute.value();
                // ...
            }
        }

        // 返回UserDetails对象，可以根据需要进行自定义
        return new CustomUserDetails(response.username(), response.enabled(), response.userStatus());
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/user/**").hasRole("USER")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .and()
                .logout().logoutSuccessUrl("/");
    }
}

import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class UserController {

    @GetMapping("/user/profile")
    public String getUserProfile(Authentication authentication) {
        // 获取自定义属性
        String customAttributeValue = authentication.getPrincipal().getCustomAttributeValue();
        // ...

        return "User Profile";
    }
}