Android应用minSdk=15时，如何绕过API23限制实现Amazon Cognito集成Google Sign-in？

Great question—supporting API 15 while integrating Amazon Cognito with Google Sign-In is totally feasible, you just need to work around the official SDK's API level restrictions. Here are two reliable approaches:

1. Use Older Google Play Services Auth SDK + Cognito Custom Identity Provider #

The official AWS docs require API 23+ because they lean on the newer Google Sign-In library, but older versions of Google Play Services Auth support down to API 15. Here's how to set this up:

• Add compatible Google Play Services dependency: In your build.gradle (Module level), use this version which supports API 15:

  implementation 'com.google.android.gms:play-services-auth:10.2.1'
  

• Implement legacy Google Sign-In flow: Instead of the modern GoogleSignInClient, use the older GoogleApiClient approach to get a Google ID Token. Here's a quick snippet:

  GoogleApiClient mGoogleApiClient = new GoogleApiClient.Builder(this)
      .addConnectionCallbacks(this)
      .addOnConnectionFailedListener(this)
      .addApi(Auth.GOOGLE_SIGN_IN_API, new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
          .requestIdToken("YOUR_GOOGLE_CLIENT_ID")
          .requestEmail()
          .build())
      .build();
  

  When the user signs in successfully, extract the ID Token from GoogleSignInAccount:

  @Override
  public void onActivityResult(int requestCode, int resultCode, Intent data) {
      super.onActivityResult(requestCode, resultCode, data);
      if (requestCode == RC_SIGN_IN) {
          GoogleSignInResult result = Auth.GoogleSignInApi.getSignInResultFromIntent(data);
          if (result.isSuccess()) {
              GoogleSignInAccount account = result.getSignInAccount();
              String idToken = account.getIdToken();
              // Pass this token to Cognito next
          }
      }
  }
  

• Configure Cognito Custom Identity Provider:
  1. Go to your Amazon Cognito Identity Pool console
  2. Under "Authentication providers", add Google as an OpenID Connect provider
  3. Enter your Google client ID (the same one used in the Android app)
  4. In your app code, use CognitoCredentialsProvider to authenticate with the ID Token:

     CognitoCredentialsProvider credentialsProvider = new CognitoCredentialsProvider(
         "YOUR_AWS_REGION",
         "YOUR_IDENTITY_POOL_ID",
         idToken,
         "accounts.google.com",
         null
     );
     

2. WebView-Based Google OAuth 2.0 Flow (No Play Services Dependency) #

If you want to avoid relying on Google Play Services entirely (which is helpful for devices that don't have it installed), use a WebView to handle the Google OAuth flow directly:

• Set up Google OAuth 2.0 in Google Cloud Console:
  • Create an OAuth 2.0 client ID for a "Web application" (even though this is an Android app)
  • Add a custom redirect URI like com.your.app:/oauth2callback (make sure this matches what you'll use in your app)
• Implement WebView flow:
  1. Create an Activity with a WebView and load Google's authorization URL:

     String authUrl = "https://accounts.google.com/o/oauth2/v2/auth?" +
         "client_id=YOUR_WEB_CLIENT_ID" +
         "&redirect_uri=com.your.app:/oauth2callback" +
         "&response_type=id_token" +
         "&scope=openid email profile" +
         "&nonce=YOUR_RANDOM_NONCE"; // Important for security
     webView.loadUrl(authUrl);
     

  2. Override shouldOverrideUrlLoading to intercept the redirect URI and extract the ID Token:

     @Override
     public boolean shouldOverrideUrlLoading(WebView view, String url) {
         if (url.startsWith("com.your.app:/oauth2callback")) {
             Uri uri = Uri.parse(url);
             String idToken = uri.getQueryParameter("id_token");
             // Validate the token (check nonce, signature) then pass to Cognito
             return true;
         }
         return false;
     }
     

• Authenticate with Cognito: Use the same CognitoCredentialsProvider approach as in the first method, passing the extracted ID Token.

Key Notes for Both Approaches #

• Security First: For the WebView method, always validate the ID Token's signature and nonce to prevent token tampering. For the Play Services method, ensure your Google client ID is properly restricted to your app's package name and SHA-1 fingerprint.
• Fallback Logic: If using the Play Services approach, add a check for Google Play Services availability with GoogleApiAvailability.getInstance().isGooglePlayServicesAvailable(this). If it's not available, switch to the WebView flow.
• Testing: Make sure to test on an API 15 emulator or device to catch any compatibility issues (like deprecated methods or layout quirks).

内容的提问来源于stack exchange，提问作者Muhamed El-Banna