我已经整合了 oauth2-proxy aws aws cognito cognito cognito opagnito eververaging Istio所述=“ https://www.jetstack.io/blog/istio-oidc/” rel =“ nofollow noreferrer”> Jetstack的文章，所有这些都在K8中运行。
现在，我正在寻找一种方法来获取用户数据和其他属性喜欢性别， phone_number ，甚至获取 cognito：ground> cognito：groups 在我的前端应用程序中的值。所有这些信息都存在于JWT有效载荷中，但不在前端侧。
想法：
- API呼吁 oauth2-proxy
/auth2/userInfo 返回用户电子邮件的端点。不多，对吧？
- 我发现 cognitio 返回更多，但我不喜欢用
aws-sdk 锁定前端的想法，或者在FE方面与JWT达成任何交易。
- 构建一个后端服务，该服务返回JWT的有效负载输出，以自定义标题 istio的requestAuthentication功能，例如 whoami 。但是，等等，另外一份微服务？
这些对我来说似乎都不是对的。
我应该采取更好的方法吗？例如，为了扩展OAuth2-Proxy的/auth2/userInfo 端点以返回更多的电子邮件，
请感谢任何帮助
谢谢！
I have integrated oauth2-proxy with AWS Cognito leveraging Istio as described in jetstack's article, all is running in K8S.
Now I am looking for an approach to get users' data and other attributes like gender, phone_number, or even get cognito:groups value in my frontend app. All this info is present in a JWT payload but not on the frontend side.
Ideas:
- An API call to oauth2-proxy's
/auth2/userinfo endpoint that returns users' email. Not much, right?
- I found that Cognito's oauth2/userInfo should return much more but I don't like the idea to lock my frontend with the
aws-sdk or have any deals with JWT on FE side.
- Build a backend service that returns a JWT's payload output in custom header leveraging outputPayloadToHeader Istio's RequestAuthentication feature, like whoami does. But wait, one more microservice?
None of these seems right to me.
Is there a better approach that I should take? For example, to extend the oauth2-proxy's /auth2/userinfo endpoint to return more than just an email
I would appreciate any help
Thanks!
发布评论
评论（1）
看起来您正在使用
后端进行前端方法，而Oauth代理执行了BFF角色。前端应该能够询问userInfo或ID令牌的信息，如这个curity示例。但是，似乎有一个漫长的问题您需要解决。
感觉应该在现有的API中完成最干净的解决方法，例如
get /userclaims < /code>。 API接收访问令牌，因此可以将其发送到Cognito UserInfo端点，然后将结果返回到客户端。这避免了需要在客户端或AWS库中使用JWT。这是一些称为Cognito的UserInfo端点。这也可能是一种机制，可以包括域特定的主张在UserInfo中返回到UI。
Looks like you are using a
Backend for Frontendapproach, with OAuth Proxy performing the BFF role. A frontend should be able to ask for userinfo or information from the ID token, as in this Curity example.However, there seems to be a long outstanding issue with this implementation that you'll need to work around.
Feels like the cleanest workaround should be done in an existing API, in an endpoint such as
GET /userclaims. The API receives access tokens so can send them to the Cognito userinfo endpoint, then return results to the client. This avoids the need to use JWTs in the client, or AWS libraries.Here is some API code of mine that calls Cognito's userinfo endpoint. This can also be a mechanism for including domain specific claims in the userinfo returned to the UI.