如何通過Android上的retrofit2調用帶有Cognito憑證的API網關？

Question

我在我的android應用程序中使用retrofit2進行任何http/rest調用。現在我需要調用一個由Amazon AWS API Gateway生成的api。

的AWS文檔say我應該生成客戶端代碼拋出API網關控制檯和使用類ApiClientFactory建立請求：

ApiClientFactory factory = new ApiClientFactory(); 

// Use CognitoCachingCredentialsProvider to provide AWS credentials 
// for the ApiClientFactory 
AWSCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider(
     context,   // activity context 
     "identityPoolId", // Cognito identity pool id 
     Regions.US_EAST_1 // region of Cognito identity pool 
}; 

factory.credentialsProvider(credentialsProvider); 

// Create an instance of your SDK (this should come from the generated code). 
final MyApiClient client = factory.build(MyApiClient.class); 

// Invoke a method (e.g., 'parentPath1Get(param1,body)') exposed by your SDK. 
// Here the method's return type is OriginalModel. 
OriginalModel output = client.parentPath1Get(param1,body); 

// You also have access to your API's models. 
OriginalModel myModel = new OriginalModel(); 
myModel.setStreetAddress(streetAddress); 
myModel.setCity(city); 
myModel.setState(state); 
myModel.setStreetNumber(streetNumber); 
myModel.setNested(nested); 
myModel.setPoBox(poBox); 

相反，我想定義的API就像我會retrofit：與我寫的接口，將其連接到RxJava，OkHttp等...

我的問題是：如何使用Cognito Identity Provider簽署改造請求？

Answer 1

創建基於@ thanhbinh84答案的OkHttp攔截。試一試：https://github.com/Ghedeon/AwsInterceptor

Answer 2

簽名過程記錄在這裏：http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html

但你也許可以嘗試重用一些從默認網關API客戶端依賴於核心運行時組件的代碼。由於簽名過程是衆所周知的，因此可能已有用於簽署RxJava或OkHttp類型請求的庫。

Answer 3

我花了好幾天才弄清楚如何使它工作。不知道他們爲什麼不指出課程而不是十幾個文檔頁面。總共有4個步驟，你必須在工作線程，我使用Rxjava打電話，但你可以使用的AsyncTask代替：

Observable.create((Observable.OnSubscribe<String>) subscriber -> { 
//Step 1: Get credential, ask server team for Identity pool id and regions    
CognitoCachingCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider(
       this, // Context 
       "Identity Pool ID", // Identity Pool ID 
       Regions.US_EAST_1 // Region 
      ); 

//Step 2: Get these 3 three keys, test with postman v4.9.3 to see if identity is correct 
      String identityId = credentialsProvider.getIdentityId(); 
      Log.show("identityId = " + identityId); 

      String AccessKey = credentialsProvider.getCredentials().getAWSAccessKeyId(); 
      String SecretKey = credentialsProvider.getCredentials().getAWSSecretKey(); 
      String SessionKey = credentialsProvider.getCredentials().getSessionToken(); 

      Log.show("AccessKey = " + AccessKey); 
      Log.show("SecretKey = " + SecretKey); 
      Log.show("SessionKey = " + SessionKey); 
//Step 3: Create an aws requets and sign by using AWS4Signer class 
      AmazonWebServiceRequest amazonWebServiceRequest = new AmazonWebServiceRequest() { 
      }; 

      ClientConfiguration clientConfiguration = new ClientConfiguration(); 

      String API_GATEWAY_SERVICE_NAME = "execute-api"; 

      Request request = new DefaultRequest(amazonWebServiceRequest,API_GATEWAY_SERVICE_NAME); 
      request.setEndpoint(URI.create("YOUR_URI")); 
      request.setHttpMethod(HttpMethodName.GET); 

      AWS4Signer signer = new AWS4Signer(); 
      signer.setServiceName(API_GATEWAY_SERVICE_NAME); 
      signer.setRegionName(Region.getRegion(Regions.US_EAST_1).getName()); 
      signer.sign(request, credentialsProvider.getCredentials()); 

      Log.show("Request header " + request.getHeaders().toString()); 
//Step 4: Create new request with authorization headers 

      OkHttpClient httpClient = new OkHttpClient(); 
      Map<String, String> headers = request.getHeaders(); 
      List<String> key = new ArrayList<String>(); 
      List<String> value = new ArrayList<String>(); 

      for (Map.Entry<String, String> entry : headers.entrySet()) 
      { 
       key.add(entry.getKey()); 
       value.add(entry.getValue()); 
      } 

      try { 
       okhttp3.Request request2 = new okhttp3.Request.Builder() 
         .url("Your_url") // remember to add/to the end of the url, otherwise the signature will be different 
         .addHeader(key.get(0), value.get(0)) 
         .addHeader(key.get(1), value.get(1)) 
         .addHeader(key.get(2), value.get(2)) 
         .addHeader(key.get(3), value.get(3)) 

         .addHeader("Content-Type", "application/x-www-form-urlencoded") 
         .build(); 
       Response response = null; 

       response = httpClient.newCall(request2).execute(); 
       String body = response.body().string(); 
       Log.show("response " + body); 
      } catch (Exception e) { 
       Log.show("error " + e); 
      } 

      subscriber.onNext(identityId); 

     }).subscribeOn(Schedulers.io()).observeOn(AndroidSchedulers.mainThread()).subscribe(new Subscriber<String>() { 
      @Override 
      public void onCompleted() { 

      } 

      @Override 
      public void onError(Throwable e) { 
       Log.show("Throwable = " + e.getMessage()); 
      } 

      @Override 
      public void onNext(String s) { 

      } 
     }); 

這裏的關鍵是AWS4Signer類做4個步驟記錄here，你不需要從頭開始構建一個。爲了使用AWS4Signer和AmazonWebServiceRequest，你需要導入AWS SDK的gradle中：

compile 'com.amazonaws:aws-android-sdk-cognito:2.3.9'