API 网关 - 自定义授权方不工作

Question

我在 AWS ApiGateway 上配置/使用身份验证时遇到了一些问题。我已经使用接收 AWS 身份验证模型的代码设置了我的 lambda 函数，见下文，它基本上解码 JWT 令牌并验证给定用户是否可以访问资源：

{
"type": "TOKEN",
"authorizationToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjotMTU1LCJwcm9kdWN0IjoiQmlsbGlvblJ1biIsInBlcm1pc3Npb25fbGV2ZWwiOjEsInNhbHQiOiJzZWNyZXRfcGhyYXNlIn0.3gZUFITe8or2mPWBAZlOxdcGF6-ybykHVsMRsqoUI_8",
"methodArn": "arn:aws:execute-api:us-east-1:123456789012:example/prod/POST/{proxy+}"

}

请参阅下面的 ApiGateway 文档的示例输出。第一个是用户验证成功（授予权限），第二个是用户验证失败（权限被拒绝）：

{
"principalId": "users",
"policyDocument": {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "execute-api:Invoke",
            "Effect": "Allow",
            "Resource": "arn:aws:execute-api:REGION:AWS_ACCOUNT:example/prod/POST/{proxy+}"
        }
    ]
},
"context": {
    "user_id": XXX,
}

}

权限被拒绝：

{
"principalId": "users",
"policyDocument": {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "execute-api:Invoke",
            "Effect": "Deny",
            "Resource": "arn:aws:execute-api:REGION:AWS_ACCOUNT:example/prod/POST/{proxy+}"
        }
    ]
}

}

问题是：每次我测试自定义授权功能时，返回状态都是200（而不是401）并且权限被授予（即使我发送了错误的令牌）。

另外，虽然屏幕显示自定义验证功能已启用，但我真的觉得它甚至没有测试任何东西。

Resource showing custom authorizer

Inside resource

Custom Authorizer

Invalid Token

Valid Token

------- 编辑 -------

这里是我如何实现输出的代码：

def generate_policy(principal_id, effect, resource, context=None):
doc = {
    'principalId': principal_id,
    'policyDocument': {
        'Version': '2012-10-17',
        'Statement': [{
            'Action': 'execute-api:Invoke',
            'Effect': effect,
            'Resource': resource
        }]
    }
}
if context:
    doc["context"] = context
return doc

所以你可以这样调用“允许”：

generate_policy("users", "Allow", method_arn, auth_info)

或者像这样“拒绝”：

generate_policy("users", "Deny", method_arn)

-------- 再次编辑 ------ 用我的所有代码要点：

https://gist.github.com/hermogenes-db18/1ccf3eb8273f266a3fa02643dcfd39bd

Answer 1

.Net Core (C#) 版本的自定义授权器

public class Function
{
    public AuthPolicy FunctionHandler(TokenAuthorizerContext request, ILambdaContext context)
    {
        var token = request.AuthorizationToken;
        var resourcePath = Environment.GetEnvironmentVariable("resourcePath");

        if (string.IsNullOrEmpty(token))
        {
            return generatePolicy("user", "Deny", request.MethodArn);
        }

        AuthPolicy policy;
        var client = new HttpClient();

        client.DefaultRequestHeaders.Accept.Clear();
        client.DefaultRequestHeaders.Add("Authorization", token);

        var dsresponse = client.GetAsync(Environment.GetEnvironmentVariable("validationURL")).Result;

        if (dsresponse.IsSuccessStatusCode)
        {
            policy = generatePolicy("user", "Allow", resourcePath);
        }
        else
        {
            policy = generatePolicy("user", "Deny", resourcePath);
        }
        return policy;
    }

    private AuthPolicy generatePolicy(string principalId, string effect, string resourcePath)
    {
        AuthPolicy authResponse = new AuthPolicy();
        authResponse.policyDocument = new PolicyDocument();
        authResponse.policyDocument.Version = "2012-10-17";// default version
        authResponse.policyDocument.Statement = new Statement[1];

        Statement statement = new Statement();
        statement.Action = "execute-api:Invoke"; // default action
        statement.Effect = effect;
        statement.Resource = resourcePath;
        authResponse.policyDocument.Statement[0] = statement;
        return authResponse;
    }
}

public class TokenAuthorizerContext
{
    public string Type { get; set; }
    public string AuthorizationToken { get; set; }
    public string MethodArn { get; set; }
}

public class AuthPolicy
{
    public PolicyDocument policyDocument { get; set; }
    public string principalId { get; set; }
}

public class PolicyDocument
{
    public string Version { get; set; }
    public Statement[] Statement { get; set; }
}

public class Statement
{
    public string Action { get; set; }
    public string Effect { get; set; }
    public string Resource { get; set; }
}

响应

请求被拒绝：

{
    "policyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "execute-api:Invoke",
                "Effect": "Deny",
                "Resource": "arn:aws:execute-api:us-east-2:AccountId:API_Id/*"
            }
        ]
    },
    "principalId": null
}

请求允许：

{
    "policyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "execute-api:Invoke",
                "Effect": "Allow",
                "Resource": "arn:aws:execute-api:us-east-2:AccountId:API_Id/*"
            }
        ]
    },
    "principalId": null
}