1~~# Connect to the EC2 instance
 2ssh -i "keypair.pem" ubuntu@ec2-xx-xxx-xxx-xxx.region-x.compute.amazonaws.com
 3# Install Java
 4sudo apt update
 5sudo apt install default-jre
 6java -version
 7# Download and extract Keycloak
 8# https://www.keycloak.org/downloads.html
 9wget https://downloads.jboss.org/keycloak/10.0.1/keycloak-10.0.1.zip
10tar -zxvf keycloak-10.0.1.tar.gz
11cd keycloak-10.0.1/
12# Create the admin user
13./bin/add-user-keycloak.sh -r master -u <username> -p <password>
14# Find the Private IP of your instance in the EC2 Console, then
15# start the Keycloak server
16./bin/standalone.sh -b XXX.XX.XX.XXX （私网 IP~~~~）~~

 1resp = requests.post(
 2    url=openid_provider + "/protocol/openid-connect/token",
 3    data={
 4        "client_secret":client_secret,
 5        "grant_type": "authorization_code",
 6        "client_id": client_id,
 7        "redirect_uri": redirect_uri,
 8        "code": auth_code,
 9        "code_verifier": code_verifier,
10    },
11    allow_redirects=False
12)
13result = resp.json()
14*# print(json.dumps(result,indent=2))*
15access_token=result['access_token']
16print ("Access Token: %s\n" %access_token)
17jwt=jwt_payload_decode(result['access_token'])
18print("JWT Token Decode:")
19print(json.dumps(jwt,indent=2))
20id_token=result['id_token']
21print("\nID Token: %s\n" %id_token)

 1
 2openid_provider = "https://keycloak.ch.test.com/auth/realms/iot" #需要替换为在 keycloak中创建的 realm 名称
 3client_id = "iotclient" #需要替换为在 keycloak realm 中创建的client 名称
 4username = "test1" #需要替换为在 keycloak realm 中创建的测试用户
 5password = "test1" #需要替换为在 keycloak realm 中创建的测试用户密码
 6redirect_uri = "http://127.0.0.1/home/login" #需要替换为在 keycloak realm 中创建的client 中 Valid Redirect URI
 7client_secret="c2669e72-d858-472c-8bda-xxxxxf" #获得 Keycloak realm 中 Client 的 Secret
 8identity_pool_id="cn-north-1:xxxxx-8c7e-0d81205xx" #获得 AWS Cognito Identity Pool Id
 9default_region_name="cn-north-1" 
10iam_openid_provider_name="keycloak.ch.test.com/auth/realms/iot" #需要替换为在 keycloak中创建的 realm 名称，注意该字符串不包含 'https://' 字符

  1# coding=utf-8
  2import boto3
  3import base64
  4import hashlib
  5import html
  6import json
  7import os
  8import re
  9import urllib.parse
 10import requests
 11
 12def _b64_decode(data):
 13    data += '=' * (4 - len(data) % 4)
 14    return base64.b64decode(data).decode('utf-8')
 15def jwt_payload_decode(jwt):
 16    _, payload, _ = jwt.split('.')
 17    return json.loads(_b64_decode(payload))
 18    
 19openid_provider = "https://keycloak.ch.test.com/auth/realms/iot" #需要替换为在 keycloak中创建的 releam 名称
 20client_id = "iotclient" #需要替换为在 keycloak releam 中创建的client 名称
 21username = "test1" #需要替换为在 keycloak releam 中创建的测试用户
 22password = "test1" #需要替换为在 keycloak releam 中创建的测试用户密码
 23redirect_uri = "http://127.0.0.1/home/login" #需要替换为在 keycloak releam 中创建的client 中 Valid Redirect URI
 24client_secret="c2669e72-d858-472c-8bda-f9xxxxxx" #获得 Keycloak Releam 中 Client 的 Secret
 25identity_pool_id="cn-north-1:xxxxx-8c7e-0d81xxxxxa" #获得 AWS Cognito identity pool id
 26default_region_name="cn-north-1" 
 27iam_openid_provider_name="keycloak.ch.test.com/auth/realms/iot" #需要替换为在 keycloak中创建的 releam 名称，注意该字符串不包含 'https://' 字符
 28
 29#Why use PKCE in keycloak
 30'''
 31From: 
 32PKCE support with Keycloak 7.0: Keycloak 7.0 has been released on Aug 25th 2019 with PKCE support. This represents a major breakthrough for all mobile apps to increase security and to mitigate malicious attacks
 33Public client security vulnerability
 34OAuth 2.0 [RFC6749] public clients are susceptible to the authorization code interception attack.
 35In this attack, the attacker intercepts the authorization code returned from the authorization endpoint within a communication path not protected by Transport Layer Security (TLS), such as interapplication communication within the client’s operating system.
 36Once the attacker has gained access to the authorization code, it can use it to obtain the access token.
 37'''
 38#generate code_verifier
 39code_verifier = base64.urlsafe_b64encode(os.urandom(40)).decode('utf-8')
 40code_verifier = re.sub('[^a-zA-Z0-9]+', '', code_verifier)
 41print("==================")
 42print("code_verifier: %s" %code_verifier)
 43#generate code_challenge
 44code_challenge = hashlib.sha256(code_verifier.encode('utf-8')).digest()
 45code_challenge = base64.urlsafe_b64encode(code_challenge).decode('utf-8')
 46code_challenge = code_challenge.replace('=', '')
 47print("==================")
 48print("code_challenge: %s\n" %code_challenge)
 49state = "fooobarbaz"
 50resp = requests.get(
 51    url=openid_provider + "/protocol/openid-connect/auth",
 52    params={
 53        "response_type": "code",
 54        "client_id": client_id,
 55        "scope": "openid",
 56        "redirect_uri": redirect_uri,
 57        "state": state,
 58        "code_challenge": code_challenge,
 59        "code_challenge_method": "S256",
 60    },
 61    allow_redirects=False
 62)
 63
 64
 65cookie = resp.headers['Set-Cookie']
 66cookie = '; '.join(c.split(';')[0] for c in cookie.split(', '))
 67print("==================")
 68print ("cookie: %s \n"%cookie)
 69page = resp.text
 70form_action = html.unescape(re.search('<form\s+.*?\s+action="(.*?)"', page, re.DOTALL).group(1))
 71print("<form action> : %s\n"%form_action)
 72
 73resp = requests.post(
 74    url=form_action, 
 75    data={
 76        "username": username,
 77        "password": password,
 78    }, 
 79    headers={"Cookie": cookie},
 80    allow_redirects=False
 81)
 82
 83redirect = resp.headers['Location']
 84print("==================")
 85print("redirect url : %s\n"%redirect)
 86query = urllib.parse.urlparse(redirect).query
 87print("==================")
 88print("redirect_query : %s\n"%query)
 89redirect_params = urllib.parse.parse_qs(query)
 90print("==================")
 91print("redirect_params : %s\n"%redirect_params)
 92auth_code = redirect_params['code'][0]
 93print("==================")
 94print('auth-code: {0}\n'.format(auth_code))
 95resp = requests.post(
 96    url=openid_provider + "/protocol/openid-connect/token",
 97    data={
 98        "client_secret":client_secret,
 99        "grant_type": "authorization_code",
100        "client_id": client_id,
101        "redirect_uri": redirect_uri,
102        "code": auth_code,
103        "code_verifier": code_verifier,
104    },
105    allow_redirects=False
106)
107result = resp.json()
108print("==================")
109print(json.dumps(result,indent=2))
110access_token=result['access_token']
111print("==================")
112print ("Access Token: %s\n" %access_token)
113jwt=jwt_payload_decode(result['access_token'])
114print("==================")
115print("JWT Token Decode:")
116print(json.dumps(jwt,indent=2))
117id_token=result['id_token']
118print("==================")
119print("\nID Token: %s\n" %id_token)
120
121
122cognito_idp_client = boto3.client('cognito-identity',region_name=default_region_name)
123# response = cognito_idp_client.describe_identity_pool(
124#     IdentityPoolId=identity_pool_id
125# )
126# print(json.dumps(response,indent=2))
127#这里非常的关键，iam_openid_provider_name 应该是 IAM 中身份提供商中的提供商的名字
128#受众应该是 keycloak releam中的 client name
129custom_logins={iam_openid_provider_name : id_token}
130
131response = cognito_idp_client.get_id(IdentityPoolId=identity_pool_id, Logins=custom_logins)
132identity_id = response['IdentityId']
133print("==================")
134print ("\nIdentity ID: %s" %identity_id)
135
136resp = cognito_idp_client.get_credentials_for_identity(IdentityId=identity_id,Logins=custom_logins)
137secretKey = resp['Credentials']['SecretKey']
138accessKey = resp['Credentials']['AccessKeyId']
139sessionToken = resp['Credentials']['SessionToken']
140expiration = resp['Credentials']['Expiration']
141print("==================")
142print ("\nSecret Key: %s"%(secretKey))
143print("==================")
144print ("\nAccess Key: %s"%(accessKey))
145print("==================")
146print ("\nSession Token: %s"%(sessionToken))
147print("==================")
148print ("\nExpiration: %s"%(expiration))
149print("==================")