基于aws api gateway的asp.net core验证

本文是介绍aws 作为api gateway，用asp.net core用web应用，.net core作为aws lambda function。

api gateway和asp.net core的用处不废话，直接上操作步骤。

首先在asw的凭据管理中添加操作的用户和角色，步骤如下：

 

注意选择的策略名称

 

下载csv备用

 

 

 

 安装aws的visual studio插件

 

 加载备用csv文件

 

 

 创建asw lambda funcation项目

 

代码如下： 

  1 using system;
  2 
  3 using amazon.lambda.apigatewayevents;
  4 
  5 using amazon.lambda.core;
  6 
  7 using microsoft.identitymodel.tokens;
  8 
  9 using system.collections.generic;
 10 
 11 using system.identitymodel.tokens.jwt;
 12 
 13 using system.linq;
 14 
 15 using system.security.claims;
 16 
 17 using system.text;
 18 
 19  
 20 
 21  
 22 
 23 [assembly: lambdaserializer(typeof(amazon.lambda.serialization.json.jsonserializer))]
 24 
 25 namespace api01awslambda
 26 
 27 {
 28 
 29     public class function
 30 
 31     {
 32 
 33  
 34 
 35         /// <summary>
 36 
 37         ///验证token的lambda函数
 38 
 39         /// </summary>
 40 
 41         /// <param name="apigauthrequest">请求</param>
 42 
 43         /// <param name="context">上下文</param>
 44 
 45         /// <returns></returns>
 46 
 47         public apigatewaycustomauthorizerresponse functionhandler(apigatewaycustomauthorizerrequest apigauthrequest, ilambdacontext context)
 48 
 49         {
 50 
 51             lambdalogger.log($"aws lambda函数验证token开始");
 52 
 53             var tokenvalidationparameters = new tokenvalidationparameters
 54 
 55             {
 56 
 57                 validateissuer = true,
 58 
 59                 validateissuersigningkey = true,
 60 
 61                 validissuer = securityconstants.issuer,
 62 
 63                 validateaudience = true,
 64 
 65                 validaudience = securityconstants.audience,
 66 
 67                 validatelifetime = true,
 68 
 69                 issuersigningkey = new symmetricsecuritykey(encoding.ascii.getbytes(securityconstants.securitykey)),
 70 
 71                 clockskew = timespan.zero,
 72 
 73             };
 74 
 75             var authorized = false;
 76 
 77             //删除bearer再来验证
 78 
 79             var token = apigauthrequest.authorizationtoken?.replace("bearer ", "");
 80 
 81             if (!string.isnullorwhitespace(token))
 82 
 83             {
 84 
 85                 try
 86 
 87                 {
 88 
 89                     securitytoken validatedtoken;
 90 
 91                     var handler = new jwtsecuritytokenhandler();
 92 
 93                     var user = handler.validatetoken(token, tokenvalidationparameters, out validatedtoken);
 94 
 95                     var claim = user.claims.firstordefault(c => c.type == claimtypes.name);
 96 
 97                     if (claim != null)
 98 
 99                     {
100 
101                         authorized = claim.value == securityconstants.claimname;
102 
103                     }
104 
105                 }
106 
107                 catch (exception ex)
108 
109                 {
110 
111                     lambdalogger.log($"error occurred validating token: {ex.message}");
112 
113                 }
114 
115             }
116 
117             var policy = new apigatewaycustomauthorizerpolicy
118 
119             {
120 
121                 version = "2012-10-17",
122 
123                 statement = new list<apigatewaycustomauthorizerpolicy.iampolicystatement>(),
124 
125  
126 
127             };
128 
129             policy.statement.add(new apigatewaycustomauthorizerpolicy.iampolicystatement
130 
131             {
132 
133                 action = new hashset<string>(new string[] { "execute-api:invoke" }),
134 
135                 effect = authorized ? "allow" : "deny",
136 
137                 resource = new hashset<string>(new string[] { apigauthrequest.methodarn })
138 
139  
140 
141             });
142 
143             var contextoutput = new apigatewaycustomauthorizercontextoutput();
144 
145             contextoutput["user"] = authorized ? securityconstants.claimname : "user";
146 
147             contextoutput["path"] = apigauthrequest.methodarn;
148 
149             lambdalogger.log($"aws lambda函数验证token结束");
150 
151             return new apigatewaycustomauthorizerresponse
152 
153             {
154 
155                 principalid = authorized ? securityconstants.claimname : "user",
156 
157                 context = contextoutput,
158 
159                 policydocument = policy,
160 
161             };
162 
163         }
164 
165     }
166 
167     /// <summary>
168 
169     /// 测试用，正式环境可以放在云配置中
170 
171     /// </summary>
172 
173     public class securityconstants
174 
175     {
176 
177         public const string issuer = "gsw";
178 
179         public const string securitykey = "abcdefghijklmnopqrstuvwxyz1234567890";
180 
181         public const string audience = "everone";
182 
183         public const string password = "111111";
184 
185         public const string claimname = "gsw";
186 
187     }
188 
189 }
190 
191  

view code

发布asw lambda funcation

  

 

选择创建的asw角色

在管理平台上查看上传的lambda funcation

 

 

 api gatewayr后台被访问的web api应用有两个：api01,api02,他们最终发布到aws api gateway能访问到的地方，我的api01是：http://helpyou.cloudapp.net:4567/abc，pai02是：，源码见https://github.com/axzxs2001/asp.netcoreexperiment/tree/master/asp.netcoreexperiment/aws，authenticationservice项目是用来产生token的，关于这部门参看我之前的博文。

 创建asw api gateway

 

 

 创建授权

 

关联api01项目和api02项目的资源文件

 

给资源添加访问方法，并关联api01的url

 

 

 添加token的键authorzation

 

 

 

添加返回状态码

 

 

 添加api02的查询参数和header

 

部署api（如果资源和方法变更后，一定要重新部署api）

 

 复制调用url(api gateway是有限流的作用的)

 

 本地启动authenticationservice，用户名gsw,密码111111，这个用户的角色是能访问api01，和api01的

 

 测试访问无token的api01,完整地址是部署的url加上资源名字,结果是401返回码

 

访问正确token的api02，结果正确返回

 

 更多asw api gateway功能请参考官方文档。