Android/AWS项目开发遇错：Cognito密钥哈希键位置及身份池登录问题求助

Hey Ronald, let's work through troubleshooting your Android/AWS project issue—connecting to an identity pool and setting up email-based login can have a few hidden gotchas, but we can break this down step by step based on the code snippet you shared and common AWS Android pitfalls.

First, let's rule out the simplest (and most common) mistakes:

• Verify that your POOL_ID (Cognito Identity Pool ID) and USER_POOL (Cognito User Pool ID) match exactly what's in the AWS Console. These IDs are case-sensitive, and even a single misplaced character will break the connection.
• Confirm your app is targeting the same AWS region where your identity/user pools are hosted. For example, if your pool is in us-east-1, make sure your SDK initialization uses Regions.US_EAST_1 (not a different region like us-west-2).

From your code, you've declared PinpointManager and DynamoDBMapper, but let's make sure the initialization logic is solid. Here's a reference snippet to compare against your implementation:

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    // Load AWS config from res/raw/awsconfiguration.json (recommended over hardcoding)
    AWSConfiguration awsConfig = AWSConfiguration.getInstance(getApplicationContext());

    // Initialize Cognito Credentials Provider (links your app to the identity pool)
    CognitoCachingCredentialsProvider credentialsProvider = new CognitoCachingCredentialsProvider(
            getApplicationContext(),
            POOL_ID, // Your Identity Pool ID
            Regions.US_EAST_1 // Replace with your pool's region
    );

    // Initialize Pinpoint (if using for analytics/engagement)
    pinpointManager = new PinpointManager.Builder(this, credentialsProvider)
            .withAppId("YOUR_PINPOINT_APP_ID") // Get this from AWS Pinpoint Console
            .withRegion(Regions.US_EAST_1)
            .build();

    // Initialize DynamoDB Mapper (if interacting with DynamoDB)
    AmazonDynamoDBClient dynamoDBClient = new AmazonDynamoDBClient(credentialsProvider);
    dynamoDBMapper = DynamoDBMapper.builder()
            .dynamoDBClient(dynamoDBClient)
            .awsConfiguration(awsConfig)
            .build();
}

Also, ensure you've added the required AWS dependencies to your app-level build.gradle:

// Core AWS SDK dependencies for Cognito, Pinpoint, and DynamoDB
implementation 'com.amazonaws:aws-android-sdk-cognito:2.62.0'
implementation 'com.amazonaws:aws-android-sdk-pinpoint:2.62.0'
implementation 'com.amazonaws:aws-android-sdk-dynamodb:2.62.0'

If your login flow is failing, here are key checks specific to email authentication:

• User Pool Settings: In the AWS Console, confirm your Cognito User Pool has email enabled as a login option (under "App integration" > "App client settings" > "Enabled identity providers" and "Login options").
• Login Implementation: Use the Cognito User Pool SDK to handle email login properly. Here's a working example:

// Initialize Cognito User Pool
CognitoUserPool userPool = new CognitoUserPool(
        getApplicationContext(),
        USER_POOL, // Your User Pool ID
        "YOUR_APP_CLIENT_ID", // Get this from User Pool "App clients"
        "YOUR_APP_CLIENT_SECRET", // Optional, if your client has a secret
        awsConfig
);

// Handle email login
String userEmail = "user@example.com";
String userPassword = "your_secure_password";
AuthenticationDetails authDetails = new AuthenticationDetails(userEmail, userPassword, null);
CognitoUser cognitoUser = userPool.getUser(userEmail);

cognitoUser.authenticateUser(authDetails, new AuthenticationHandler() {
    @Override
    public void onSuccess(CognitoUserSession userSession, CognitoDevice newDevice) {
        // Login succeeded! Link the user session to your credentials provider
        credentialsProvider.setLogins(Map.of(
                "cognito-idp." + Regions.US_EAST_1.getName() + ".amazonaws.com/" + USER_POOL,
                userSession.getIdToken().getJWTToken()
        ));
        // Proceed with app logic (e.g., fetch data from DynamoDB)
    }

    @Override
    public void onFailure(Exception exception) {
        // THIS IS CRITICAL: Log the full exception stack trace, not just the message
        Log.e("LoginError", "Login failed", exception);
        // Common failures: invalid credentials, user not confirmed, pool/client misconfig
    }

    // Implement other required methods (for MFA, additional auth details) as needed
    @Override
    public void getAuthenticationDetails(AuthenticationContinuation continuation, String userId) {}
    @Override
    public void getMFACode(MultiFactorAuthenticationContinuation continuation) {}
});

The onFailure method is your best friend here—printing the full stack trace will reveal exactly what's wrong (e.g., "User not confirmed" vs. "Invalid client ID").

• Ensure your AndroidManifest.xml includes essential network permissions:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

• For Android 9+, if you're hitting AWS endpoints over HTTPS (which you should be), you don't need to enable cleartext traffic, but if you're testing with a non-HTTPS endpoint, add a network security config to allow it.

Your identity pool's authenticated and unauthenticated roles need the right permissions to access AWS resources (like DynamoDB). For example, if you're reading/writing to DynamoDB, attach a policy like this to your authenticated role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:GetItem",
                "dynamodb:Scan"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:YOUR_ACCOUNT_ID:table/YOUR_TABLE_NAME"
        }
    ]
}

Without these permissions, even if your login succeeds, your app will throw access-denied errors when interacting with AWS services.

内容的提问来源于stack exchange，提问作者Ronald Pitt