@Test public void userPool_getClaims_retrieveCustomClaim() { AwsProxySecurityContext context = new AwsProxySecurityContext(null, REQUEST_COGNITO_USER_POOL); Principal userPrincipal = context.getUserPrincipal(); assertNotNull(userPrincipal.getName()); assertEquals(COGNITO_IDENTITY_ID, userPrincipal.getName()); assertTrue(userPrincipal instanceof AwsProxySecurityContext.CognitoUserPoolPrincipal); assertNotNull(((AwsProxySecurityContext.CognitoUserPoolPrincipal)userPrincipal).getClaims().getClaim(CLAIM_KEY)); assertEquals(CLAIM_VALUE, ((AwsProxySecurityContext.CognitoUserPoolPrincipal)userPrincipal).getClaims().getClaim(CLAIM_KEY)); }
@Override public Principal getUserPrincipal() { if (getAuthenticationScheme() == null) { return () -> null; } if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { return () -> { if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) { switch (event.getRequestSource()) { case API_GATEWAY: return event.getRequestContext().getAuthorizer().getPrincipalId(); case ALB: return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER); } } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) { return event.getRequestContext().getIdentity().getCognitoIdentityId(); } else { return event.getRequestContext().getIdentity().getUserArn(); } } return null; }; } if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) { return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims()); } throw new RuntimeException("Cannot recognize authorization scheme in event"); }
AwsProxySecurityContext implements SecurityContext { @Override public Principal getUserPrincipal() { if (getAuthenticationScheme() == null) { return () -> null; } if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { return () -> { if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) { switch (event.getRequestSource()) { case API_GATEWAY: return event.getRequestContext().getAuthorizer().getPrincipalId(); case ALB: return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER); } } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) { return event.getRequestContext().getIdentity().getCognitoIdentityId(); } else { return event.getRequestContext().getIdentity().getUserArn(); } } return null; }; } if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) { return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims()); } throw new RuntimeException("Cannot recognize authorization scheme in event"); } }
AwsProxySecurityContext implements SecurityContext { @Override public Principal getUserPrincipal() { if (getAuthenticationScheme() == null) { return () -> null; } if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { return () -> { if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) { switch (event.getRequestSource()) { case API_GATEWAY: return event.getRequestContext().getAuthorizer().getPrincipalId(); case ALB: return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER); } } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) { return event.getRequestContext().getIdentity().getCognitoIdentityId(); } else { return event.getRequestContext().getIdentity().getUserArn(); } } return null; }; } if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) { return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims()); } throw new RuntimeException("Cannot recognize authorization scheme in event"); } AwsProxySecurityContext(final Context lambdaContext, final AwsProxyRequest event); }
AwsProxySecurityContext implements SecurityContext { @Override public Principal getUserPrincipal() { if (getAuthenticationScheme() == null) { return () -> null; } if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { return () -> { if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) { switch (event.getRequestSource()) { case API_GATEWAY: return event.getRequestContext().getAuthorizer().getPrincipalId(); case ALB: return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER); } } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) { return event.getRequestContext().getIdentity().getCognitoIdentityId(); } else { return event.getRequestContext().getIdentity().getUserArn(); } } return null; }; } if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) { return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims()); } throw new RuntimeException("Cannot recognize authorization scheme in event"); } AwsProxySecurityContext(final Context lambdaContext, final AwsProxyRequest event); Context getLambdaContext(); AwsProxyRequest getEvent(); @Override Principal getUserPrincipal(); @Override boolean isUserInRole(String role); @Override boolean isSecure(); @Override String getAuthenticationScheme(); }
AwsProxySecurityContext implements SecurityContext { @Override public Principal getUserPrincipal() { if (getAuthenticationScheme() == null) { return () -> null; } if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM) || getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { return () -> { if (getAuthenticationScheme().equals(AUTH_SCHEME_CUSTOM)) { switch (event.getRequestSource()) { case API_GATEWAY: return event.getRequestContext().getAuthorizer().getPrincipalId(); case ALB: return event.getMultiValueHeaders().getFirst(ALB_IDENTITY_HEADER); } } else if (getAuthenticationScheme().equals(AUTH_SCHEME_AWS_IAM)) { if (event.getRequestContext().getIdentity().getCognitoIdentityId() != null) { return event.getRequestContext().getIdentity().getCognitoIdentityId(); } else { return event.getRequestContext().getIdentity().getUserArn(); } } return null; }; } if (getAuthenticationScheme().equals(AUTH_SCHEME_COGNITO_POOL)) { return new CognitoUserPoolPrincipal(event.getRequestContext().getAuthorizer().getClaims()); } throw new RuntimeException("Cannot recognize authorization scheme in event"); } AwsProxySecurityContext(final Context lambdaContext, final AwsProxyRequest event); Context getLambdaContext(); AwsProxyRequest getEvent(); @Override Principal getUserPrincipal(); @Override boolean isUserInRole(String role); @Override boolean isSecure(); @Override String getAuthenticationScheme();  }