1. Yol<\/th>\n	2. Yol<\/th>\n<\/tr>\n<\/thead>\n
Username, password vs. gibi g\u00f6nderilen kimlik bilgilerini(credentials) okuyacak ve bunlar\u0131 do\u011frulayacak bir lambda function geli\u015ftirece\u011fiz. Bu do\u011frulama neticesinde bir JWT d\u00f6nd\u00fcrecek ve client’\u0131 b\u00f6ylece yetkilendirece\u011fiz. Client elde edece\u011fi bu JWT de\u011feri ile request’lerini ger\u00e7ekle\u015ftirecektir.<\/p>\n Yani anlayaca\u011f\u0131n\u0131z authentication sorumlulu\u011funu \u00fcstlenecek bir uygulama olu\u015fturaca\u011f\u0131z.<\/td>\n	Lambda Authorizer, \u00f6z\u00fcnde authorizer olarak davran\u0131\u015f sergileyen ap ayr\u0131 bir AWS Lambda projesidir. Yani function’d\u0131r. Bu function’\u0131n sorumlulu\u011fu, client’lar taraf\u0131ndan yap\u0131lan istek s\u00fcre\u00e7lerinde taraf\u0131m\u0131za iletilen JWT de\u011ferlerini do\u011frulamakt\u0131r. Bu do\u011frulama neticesinde hedef lambda function tetiklenecek yok e\u011fer do\u011frulama ger\u00e7ekle\u015fmezse Amazon API Gateway taraf\u0131ndan yorumlanabilecek\/anla\u015f\u0131labilecek bir IAM politikas\u0131 d\u00f6nd\u00fcr\u00fclecektir.<\/p>\n Bu da bir authorization sorumlulu\u011fu \u00fcstlenecek uygulama olacakt\u0131r.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n O halde hadi ba\u015flayal\u0131m…<\/p>\n Authentication uygulamas\u0131n\u0131 geli\u015ftirme;<\/strong><\/p>\n \n Ad\u0131m 1 – (Uygulama Olu\u015fturma)<\/span><\/em> \nSolution i\u00e7erisinde authentication i\u015flemlerini \u00fcstlenmesi i\u00e7in AWS.Lambda.Authorizer.Example.Authentication<\/em> ad\u0131nda bir ‘Empty Function’ olu\u015ftural\u0131m.\n<\/li>\n Ad\u0131m 2 – (User Modelini Olu\u015fturma)<\/span><\/em> \nDo\u011frulama s\u00fcrecinde kullan\u0131c\u0131 bilgilerini tutmak i\u00e7in bir model tasarlayal\u0131m.<\/p>\n \n \r\n [DynamoDBTable("users")]\r\n public class User\r\n {\r\n [DynamoDBHashKey("email"), DynamoDBProperty("email")]\r\n [JsonPropertyName("email")]\r\n public string? Email { get; set; }\r\n [DynamoDBProperty("username")]\r\n [JsonPropertyName("username")]\r\n public string? Username { get; set; }\r\n [DynamoDBProperty("password")]\r\n [JsonPropertyName("password")]\r\n public string? Password { get; set; }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n Ad\u0131m 3 – DynamoDB’de Tablo Olu\u015fturma<\/span><\/em> \nTasarlanan modele uygun DynamoDB’de tablo olu\u015ftural\u0131m. $\".NET$ <\/a>\n<\/li>\n Ad\u0131m 4 – Token Generate Etme<\/span><\/em> \nKullan\u0131c\u0131 bilgilerini do\u011frulad\u0131ktan sonra token \u00fcretimini ger\u00e7ekle\u015ftirecek servisi tasarlayal\u0131m.<\/p>\n \n \r\n public interface ITokenGenerator\r\n {\r\n string GenerateJWT(User user, int minute);\r\n }\r\n<\/pre>\n<\/div>\n \n \r\n public class TokenGenerator : ITokenGenerator\r\n {\r\n public string GenerateJWT(User user, int minute)\r\n {\r\n List<Claim> claims = new() {\r\n new(ClaimTypes.Email, user.Email),\r\n new(ClaimTypes.Name,user.Username)\r\n };\r\n\r\n byte[] secretKey = Encoding.UTF8.GetBytes("doldur be meyhaneci, bo\u015f kalmas\u0131n kadehim...");\r\n\r\n SigningCredentials credentials = new(\r\n key: new SymmetricSecurityKey(secretKey),\r\n algorithm: SecurityAlgorithms.HmacSha256);\r\n\r\n JwtSecurityToken token = new(\r\n claims: claims,\r\n expires: DateTime.UtcNow.AddMinutes(minute),\r\n signingCredentials: credentials);\r\n\r\n JwtSecurityTokenHandler tokenHandler = new();\r\n return tokenHandler.WriteToken(token);\r\n }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n Ad\u0131m 5 – GenerateTokenAsync Function’\u0131n\u0131 Tasarlama<\/span><\/em> \nBu ad\u0131mda da olu\u015fturdu\u011fumuz ‘TokenGenerator’ s\u0131n\u0131f\u0131n\u0131 kullanarak gerekli JWT \u00fcretimini ger\u00e7ekle\u015ftirecek function’\u0131 tasarlayal\u0131m.<\/p>\n \n \r\nusing Amazon.DynamoDBv2;\r\nusing Amazon.DynamoDBv2.DataModel;\r\nusing Amazon.Lambda.APIGatewayEvents;\r\nusing Amazon.Lambda.Core;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Models;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Services;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Services.Abstractions;\r\nusing Microsoft.Extensions.DependencyInjection;\r\nusing System.Text.Json;\r\n\r\n\/\/ Assembly attribute to enable the Lambda function's JSON input to be converted into a .NET class.\r\n[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]\r\n\r\nnamespace AWS.Lambda.Authorizer.Example.Authentication;\r\n\r\npublic class Function\r\n{\r\n readonly IServiceProvider _serviceProvider;\r\n public Function()\r\n {\r\n ServiceCollection serviceCollection = new();\r\n serviceCollection.AddScoped<ITokenGenerator, TokenGenerator>();\r\n _serviceProvider = serviceCollection.BuildServiceProvider();\r\n }\r\n public async Task<string> GenerateTokenAsync(APIGatewayHttpApiV2ProxyRequest request, ILambdaContext context)\r\n {\r\n User? user = JsonSerializer.Deserialize<User>(request.Body);\r\n AmazonDynamoDBClient dynamoDBClient = new();\r\n DynamoDBContext dynamoDBContext = new(dynamoDBClient);\r\n\r\n User hasUser = await dynamoDBContext.LoadAsync<User>(user.Email);\r\n if (hasUser != null)\r\n {\r\n if (hasUser.Password != user.Password)\r\n throw new Exception("Invalid credentials!");\r\n\r\n using (IServiceScope scope = _serviceProvider.CreateScope())\r\n {\r\n ITokenGenerator tokenGenerator = scope.ServiceProvider.GetService<ITokenGenerator>();\r\n return tokenGenerator.GenerateJWT(user, 3);\r\n }\r\n }\r\n throw new Exception("User not found!");\r\n }\r\n}\r\n\r\n<\/pre>\n<\/div>\n<\/li>\n Ad\u0131m 5 – Function’\u0131 Publish Etme ve DynamoDB Eri\u015fim Politikas\u0131yla E\u015fle\u015ftirme<\/span><\/em> \n\u015eimdide olu\u015fturdu\u011fumuz function’\u0131 publish edelim. $\".NET$ <\/a> $\".NET$ <\/a> \nFunction’\u0131 publish ettikten sonra AWS Lambda servisinden yandaki gibi kontrol etmenizde fayda vard\u0131r. \u015eimdi bu lambda function ile DynamoDB aras\u0131nda ili\u015fki kuraca\u011f\u0131z. Bunun i\u00e7in IAM Service \u00fczerinden politikalara geliniz ve t\u00fcm aksiyonlar e\u015fli\u011finde DynamoDB eri\u015fim iznine sahip olan politikay\u0131 ilgili lambda function’la ili\u015fkilendiriniz. $\".NET$ <\/a> $\".NET$ <\/a>\n<\/li>\n Ad\u0131m 6 – API Gateway \u0130le Endpoint Alma<\/span><\/em> \nVe nihai olarak art\u0131k function’a eri\u015fip, authentication i\u015flemlerini ba\u015far\u0131yla ger\u00e7ekle\u015ftirebilmek i\u00e7in bir API Gateway \u00fczerinden endpoint ayarlayal\u0131m. Tabi burada isterseniz mevcut API Gateway’lerden birini kullanabilir yahut s\u0131rf bu i\u015flem i\u00e7in ba\u015fl\u0131 ba\u015f\u0131na bir API Gateway olu\u015fturabilirsiniz. Ben genel anlamda endpoint’in origin’i de\u011fi\u015fmemesi i\u00e7in var olan bir API Gateway \u00fczerinden bu function’a \u00f6zel bir entegrasyonda bulunaca\u011f\u0131m. Bunun i\u00e7in API Gateway servisinde a\u015fa\u011f\u0131daki g\u00f6rseldeki gibi davran\u0131\u015f sergilenmesi yeterli olacakt\u0131r. \n $\".NET$ <\/a>G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere yeni ekledi\u011fimiz function’\u0131 API Gateway ile ili\u015fkilendirdik. Bu i\u015flemin ard\u0131ndan a\u015fa\u011f\u0131daki gibi endpoint tan\u0131mlamas\u0131nda bulunabiliriz. $\".NET$ <\/a>\n<\/li>\n Ad\u0131m 7 – Test<\/span><\/em> \nVe son olarak olu\u015fturdu\u011fumuz endpoint \u00fczerinden token talebinde bulunabiliriz. \n $\".NET$ <\/a>\n<\/li>\n<\/ul>\n Evet, g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere authentication uygulamas\u0131n\u0131 ba\u015far\u0131yla geli\u015ftirmi\u015f bulunuyoruz. \u015eimdi s\u0131ra authorization uygulamas\u0131nda…<\/p>\n Authorization(Lambda Authorizer) uygulamas\u0131n\u0131 geli\u015ftirme;<\/strong><\/p>\n \n Ad\u0131m 1 – Uygulama Olu\u015fturma<\/span><\/em> \nYine ilk olarak ayn\u0131 solution i\u00e7erisinde bu sefer de authorization i\u015flemlerini \u00fcstlenmesi i\u00e7in AWS.Lambda.Authorizer.Example.Authorization<\/em> ad\u0131nda bir proje olu\u015ftural\u0131m.\n<\/li>\n Ad\u0131m 2 – Token’\u0131 Do\u011frulama<\/span><\/em> \nAuthentication uygulamas\u0131ndan al\u0131nm\u0131\u015f olan token’\u0131 do\u011frulamak i\u00e7in gerekli servisi olu\u015ftural\u0131m.<\/p>\n \n \r\n public interface ITokenValidator\r\n {\r\n ClaimsPrincipal ValidateToken(string accessToken);\r\n }\r\n<\/pre>\n<\/div>\n \n \r\n public class TokenValidator : ITokenValidator\r\n {\r\n public ClaimsPrincipal ValidateToken(string accessToken)\r\n {\r\n JwtSecurityTokenHandler tokenHandler = new();\r\n\r\n byte[] secretKey = Encoding.UTF8.GetBytes("doldur be meyhaneci, bo\u015f kalmas\u0131n kadehim...");\r\n\r\n TokenValidationParameters validationParameters = new()\r\n {\r\n ValidateLifetime = true,\r\n ValidateAudience = false,\r\n ValidateIssuer = false,\r\n IssuerSigningKey = new SymmetricSecurityKey(secretKey),\r\n };\r\n\r\n\r\n try\r\n {\r\n ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(\r\n token: accessToken,\r\n validationParameters: validationParameters,\r\n validatedToken: out SecurityToken _);\r\n return claimsPrincipal;\r\n }\r\n catch (Exception ex)\r\n {\r\n return null;\r\n }\r\n }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n Ad\u0131m 3 – ValidateToken Function’\u0131n\u0131 Tasarlama<\/span><\/em> \n\u015eimdi de olu\u015fturdu\u011fumuz ‘TokenValidator’ s\u0131n\u0131f\u0131n\u0131 kullanarak token’\u0131 do\u011frulayacak olan function’\u0131 olu\u015ftural\u0131m.<\/p>\n \n \r\nusing Amazon.Lambda.APIGatewayEvents;\r\nusing Amazon.Lambda.Core;\r\nusing AWS.Lambda.Authorizer.Example.Authorization.Services;\r\nusing AWS.Lambda.Authorizer.Example.Authorization.Services.Abstractions;\r\nusing Microsoft.Extensions.DependencyInjection;\r\nusing System.Security.Claims;\r\nusing System.Text.Json;\r\n\r\n\/\/ Assembly attribute to enable the Lambda function's JSON input to be converted into a .NET class.\r\n[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]\r\n\r\nnamespace AWS.Lambda.Authorizer.Example.Authorization;\r\n\r\npublic class Function\r\n{\r\n readonly IServiceProvider _serviceProvider;\r\n public Function()\r\n {\r\n ServiceCollection serviceCollection = new();\r\n serviceCollection.AddScoped<ITokenValidator, TokenValidator>();\r\n _serviceProvider = serviceCollection.BuildServiceProvider();\r\n }\r\n public APIGatewayCustomAuthorizerResponse TokenValidator(APIGatewayCustomAuthorizerRequest request, ILambdaContext context)\r\n {\r\n string accessToken = request.Headers["authorization"];\r\n ITokenValidator tokenValidator = _serviceProvider.GetRequiredService<ITokenValidator>();\r\n ClaimsPrincipal claimsPrincipal = tokenValidator.ValidateToken(accessToken);\r\n\r\n string? principalId = "401";\r\n if (claimsPrincipal is { Identity.IsAuthenticated: true })\r\n principalId = claimsPrincipal.FindFirst(ClaimTypes.Name)?.Value;\r\n\r\n return new APIGatewayCustomAuthorizerResponse()\r\n {\r\n PrincipalID = principalId,\r\n PolicyDocument = new APIGatewayCustomAuthorizerPolicy\r\n {\r\n Statement = new List<APIGatewayCustomAuthorizerPolicy.IAMPolicyStatement>\r\n {\r\n new APIGatewayCustomAuthorizerPolicy.IAMPolicyStatement()\r\n {\r\n Effect = claimsPrincipal != null ? "Allow" : "Deny",\r\n Resource = new HashSet<string>{ "arn:aws:execute-api:ap-south-1:567921601443:uyv8v6df12\/\/" },\r\n Action = new HashSet<string>{ "execute-api:Invoke" }\r\n }\r\n }\r\n }\r\n };\r\n }\r\n}\r\n<\/pre>\n<\/div>\n Evet, olu\u015fturulan function’\u0131n detaylar\u0131ndan bahsetmemiz gerekti\u011fi a\u015fikar. O halde ilk olarak APIGatewayCustomAuthorizerRequest<\/code> ve APIGatewayCustomAuthorizerResponse<\/code> olmak \u00fczere parametre ve geri d\u00f6n\u00fc\u015f t\u00fcrlerini ele alarak ba\u015flayal\u0131m. Bu referanslar, Lambda Authorizer i\u00e7in kullan\u0131lan \u00f6zel s\u0131n\u0131flard\u0131r. APIGatewayCustomAuthorizerRequest<\/code> s\u0131n\u0131f\u0131 JWT do\u011frulamak i\u00e7in gelen istekleri temsil ederken bizlere bu istekle ilgili headers, query string ve di\u011fer bilgileri getirmektedir. Ayn\u0131 \u015fekilde APIGatewayCustomAuthorizerResponse<\/code> s\u0131n\u0131f\u0131 ise yetkilendirme neticesinde gerekli bilgileri i\u00e7erecek olan (ad\u0131 \u00fczerinde) response’u temsil etmektedir.<\/p>\n APIGatewayCustomAuthorizerResponse<\/code> nesnesinin property’lerine gelirsek e\u011fer; PrincipalID<\/code> property’si, JWT do\u011fruland\u0131\u011f\u0131 taktirde ‘name’ claim’inin de\u011ferini, yok e\u011fer do\u011frulanmazsa “401” de\u011ferini almaktad\u0131r. PolicyDocument<\/code> property’si, APIGatewayCustomAuthorizerPolicy<\/code> t\u00fcr\u00fcnden nesne alan bu property lambda authorizer taraf\u0131ndan API Gateway’e g\u00f6nderilen ve yetkilendirmenin ba\u015far\u0131l\u0131 olup olmad\u0131\u011f\u0131n\u0131 ifade edecek olan yan\u0131t ama\u00e7l\u0131 kullan\u0131lmaktad\u0131r. Bu nesnenin de ‘Effect’, ‘Resource’ ve ‘Action’ property’leri mevcuttur. Bu property’lerden; ‘Effect’, yetkilendirmenin ba\u015far\u0131l\u0131 olup olmad\u0131\u011f\u0131n\u0131 ifade etmektedir. \u00d6rnekte de g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere ba\u015far\u0131l\u0131ysa ‘Allow’ de\u011filse ‘Deny’ de\u011ferlerini almaktad\u0131r. ‘Resource’, i\u015flem yap\u0131lacak kayna\u011f\u0131n ad\u0131n\u0131 temsil etmektedir. ‘Action’ ise i\u015flem yap\u0131lacak kayna\u011f\u0131n \u00fczerinde yap\u0131lacak eylemi\/i\u015flemi temsil etmektedir.<\/p>\n `Tabi burada ‘Resource’ property’sine biraz daha odaklanmam\u0131z gerekmektedir. ‘Resource’, yap\u0131sal olarak bir ARN(Amazon Resource Name) format\u0131nda de\u011fer beklemektedir. ARN’ler AWS’de ki kaynaklar\u0131n benzersiz tan\u0131mlay\u0131c\u0131s\u0131d\u0131rlar. Misal olarak bir lambda function’\u0131n ARN de\u011feri \u015f\u00f6yle olmal\u0131d\u0131r:<\/p>\n` \narn:aws:execute-api:<aws-region><\/span>:<aws-account-id><\/span>:<amazon-gateway-id><\/span>\/\/<\/span><\/strong>\n<\/div>\n\n<aws-region><\/span> : AWS servislerinin bulundu\u011fu b\u00f6lgenin de\u011ferini ifade eder.<\/li>\n <aws-account-id><\/span> : AWS Account ID’yi ifade eder. Bu de\u011fer i\u00e7in AWS sayfas\u0131ndan sa\u011f \u00fcst k\u00f6\u015fedeki profilinize t\u0131klaman\u0131z yeterli olacakt\u0131r.<\/a><\/li>\n <amazon-gateway-id><\/span> : API Gateway’in ID de\u011ferini ifade eder. Bu de\u011fer i\u00e7in ise ilgili API Gateway’in detaylar\u0131na bakman\u0131z yeterli olacakt\u0131r.<\/a><\/li>\n<\/ul>\n<\/li>\n Ad\u0131m 4 – Function’\u0131 Publish Etme<\/span><\/em> \nOlu\u015fturulan function’\u0131 publish edelim.<\/a>\n<\/li>\n Ad\u0131m 5 – Endpoint’e Lambda Authorizer Olarak Tan\u0131mlama<\/span><\/em> \nVe son olarak istenilen herhangi bir endpoint’in g\u00fcvenli\u011fini sa\u011flayabilmek i\u00e7in ilgili function’\u0131 o endpoint’e lambda authorizer olarak ekleyelim. Bunun i\u00e7in API Gateway sayfas\u0131nda istedi\u011finiz endpoint’i se\u00e7ebilirsiniz.<\/a>Misal olarak bizler yukar\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi GET t\u00fcr\u00fcnden olan ‘\/persons’ endpoint’ine bu function’\u0131 authorizer olarak atamak istedi\u011fimiz taktirde ilgili endpoint’i se\u00e7ip devam\u0131nda sa\u011f taraftaki ‘Attach authorization’ butonuna t\u0131klamal\u0131y\u0131z.<\/a>Ard\u0131ndan ‘Create and attach an authorizer’ butonuna t\u0131klayarak devam edelim.<\/a>Devam\u0131nda ise authorizer type olarak ‘Lambda’ sekmesini se\u00e7elim ve gerekli alanlar\u0131 yukar\u0131daki gibi doldural\u0131m.<\/a>Tasarlad\u0131\u011f\u0131m\u0131z lambda authorizer gelen istekleri do\u011frulamak i\u00e7in IAM politikas\u0131 d\u00f6nd\u00fcrd\u00fc\u011f\u00fcnden dolay\u0131 ‘IAM Policy’ sekmesini se\u00e7elim.<\/a>T\u00fcm bu i\u015flemler neticesinde API Gateway ekran\u0131nda ‘Authorization’ sayfas\u0131na bakt\u0131\u011f\u0131m\u0131zda ilgili endpoint’in ‘Lambda Auth’ ile i\u015faretlendi\u011fini g\u00f6rerek, yetkilendirilmeye tabii tutuldu\u011funu anlayabilmekteyiz.<\/p>\n<\/li>\n Ad\u0131m 6 – Test<\/span><\/em> \nArt\u0131k yapt\u0131\u011f\u0131m\u0131z t\u00fcm bu \u00e7al\u0131\u015fmalar\u0131n nihai testini ger\u00e7ekle\u015ftirebiliriz.<\/a>\n<\/li>\n<\/ul>\nEvet… G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Lambda Authorizer yap\u0131land\u0131rmas\u0131 i\u015fte bu kadar \ud83d\ude42 K\u0131ssadan hisse yaparsak, bir authentication bir de authorization i\u015flemlerinin sorumlulu\u011funu \u00fcstlenen ayr\u0131 function’lar taraf\u0131ndan rahatl\u0131kla ger\u00e7ekle\u015ftirilebilmekte ve hangi endpoint’i koruyacaksak ilgili authorization uygulamas\u0131 onunla e\u015fle\u015ftirilmektedir.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\nNot : \u00d6rnek projeyi a\u015fa\u011f\u0131daki github adresinden edinebilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/AWS.Lambda.Authorizer.Example<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde, \u00f6nceden .NET 7 \u2013 AWS Lambda \u0130le Serverless Computing ve .NET \u0130le Amazon API Gateway \u2013 AWS Lambda & DynamoDB Entegrasyonu ba\u015fl\u0131klar\u0131 alt\u0131nda kaleme ald\u0131\u011f\u0131m\u0131z makalelerimizde inceledi\u011fimiz AWS Lambda ve Amazon...<\/p>\n","protected":false},"author":1,"featured_media":26163,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4446,4754,2739,4730],"tags":[4769,4773,4771,4772,4766,4770,4767,4768],"class_list":["post-26157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net-6","category-net-7","category-net-core","category-aws","tag-a-request-parameter-based-lambda-authorizer","tag-amazon-resource-name","tag-apigatewaycustomauthorizerrequest","tag-apigatewaycustomauthorizerresponse","tag-lambda-authorizer","tag-request-authorizer","tag-token-authorizer","tag-token-based-lambda-authorizer"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=26157"}],"version-history":[{"count":21,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157\/revisions"}],"predecessor-version":[{"id":26201,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157\/revisions\/26201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/26163"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=26157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=26157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=26157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

<\/div>\n

Merhaba,<\/p>\n

Bu i\u00e7eri\u011fimizde, \u00f6nceden .NET 7 \u2013 AWS Lambda \u0130le Serverless Computing<\/a> ve .NET \u0130le Amazon API Gateway \u2013 AWS Lambda & DynamoDB Entegrasyonu<\/a> ba\u015fl\u0131klar\u0131 alt\u0131nda kaleme ald\u0131\u011f\u0131m\u0131z makalelerimizde inceledi\u011fimiz AWS Lambda ve Amazon API Gateway konular\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flayabilmek i\u00e7in Amazon taraf\u0131ndan sunulan Lambda Authorizer<\/em> \u00f6zelli\u011fini inceleyecek ve teknik olarak nas\u0131l yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131n\u0131 tecr\u00fcbe ediyor olaca\u011f\u0131z.<\/p>\n

Lambda Authorizer Nedir?<\/h5>\n
Olu\u015fturdu\u011fumuz AWS Lambda Function’lar\u0131n\u0131 kullanabilmek i\u00e7in Amazon API Gateway taraf\u0131ndan \u00fcretilmi\u015f olan endpoint’lere kar\u015f\u0131n eri\u015fim haklar\u0131n\u0131 y\u00f6netmek i\u00e7in kullan\u0131lan esnek, yap\u0131land\u0131r\u0131labilir bir yetkilendirme mekanizmas\u0131d\u0131r.<\/p>\n
Lambda Authorizer iki farkl\u0131 t\u00fcrde mevcuttur;<\/p>\n
\n
Token-Based Lambda Authorizer<\/em><\/strong>
\n\u0130lgili endpoint’e istek g\u00f6nderen ki\u015finin bilgilerini Bearer Token<\/em> olarak JSON Web Token(JWT)<\/em> format\u0131nda almaktad\u0131r. Ayr\u0131ca TOKEN Authorizer<\/em> olarakta nitelendirilmektedir.\n<\/li>\n
A Request Parameter-Based Lambda Authorizer<\/em><\/strong>
\n\u0130lgili endpoint’e istek g\u00f6nderen ki\u015finin bilgilerini request’in header b\u00f6l\u00fcm\u00fcnden veya query string de\u011ferlerinden almaktad\u0131r. Bu y\u00f6nteme de ayr\u0131ca REQUEST Authorizer<\/em> dendi\u011fini g\u00f6rebilirsiniz. WebSocket API’leri i\u00e7in bu y\u00f6ntem kullan\u0131ma daha yatk\u0131nd\u0131r.\n<\/li>\n<\/ul>\nLambda Authorizer Workflow’u Nas\u0131ld\u0131r?<\/h5>\n
Amazon API Gateway \u00fczerinden AWS Lambda Function’lar\u0131na yap\u0131lan istek s\u00fcre\u00e7lerinde Lambda Authorizer’\u0131n sergiledi\u011fi davran\u0131\u015f\u0131 anlayabilmek i\u00e7in a\u015fa\u011f\u0131daki i\u015f ak\u0131\u015f\u0131 diyagram\u0131na g\u00f6z atabilirsiniz. $\".NET$ <\/a><\/p>\n
\n
1. Ad\u0131m<\/em>
\nClient, bir bearer token yahut request parameter e\u015fli\u011finde API Gateway \u00fczerinden bir endpoint’e istek g\u00f6nderir.\n<\/li>\n
2. Ad\u0131m<\/em>
\nAPI Gateway ise endpoint’e kar\u015f\u0131l\u0131k bir Lambda Authorizer’\u0131n yap\u0131land\u0131r\u0131l\u0131p yap\u0131land\u0131r\u0131lmad\u0131\u011f\u0131n\u0131 kontrol eder. E\u011fer herhangi bir Lambda Authorizer yap\u0131land\u0131rmas\u0131 s\u00f6z konusu de\u011filse endpoint’e kar\u015f\u0131l\u0131k lambda function tetiklenecektir. Yok e\u011fer Lambda Authorizer yap\u0131land\u0131r\u0131lm\u0131\u015fsa s\u00fcrecin devam\u0131 ger\u00e7ekle\u015fecektir.\n<\/li>\n
3. Ad\u0131m<\/em>
\nHedef lambda function tetiklenmeden \u00f6nce istek yapan ki\u015finin kimli\u011fi a\u015fa\u011f\u0131daki yollarla do\u011frulanmaya \u00e7al\u0131\u015f\u0131l\u0131r.<\/p>\n
\n
Bir OAuth access token’\u0131 alabilmek i\u00e7in bir OAuth provider’\u0131n\u0131 \u00e7a\u011f\u0131rmak<\/li>\n
SAML onay\u0131 almak i\u00e7in bir SAML provider’\u0131n\u0131 \u00e7a\u011f\u0131rmak<\/li>\n
Request parameter de\u011ferine g\u00f6re bir IAM politikas\u0131 olu\u015fturmak<\/li>\n
Credentials bilgilerini bir database’den almak<\/li>\n<\/ul>\n<\/li>\n
4. Ad\u0131m<\/em>
\nBu yollardan hangisi olursa olsun ba\u015far\u0131l\u0131 bir netice s\u00f6z konusuysa lambda authorizer, en az bir IAM politikas\u0131(IAM policy) ve ana tan\u0131mlay\u0131c\u0131(principal identifier) i\u00e7eren bir output object return ederek eri\u015fim izni verir.\n<\/li>\n
5. Ad\u0131m<\/em>
\nVe son olarak API Gateway gelen IAM policy’i de\u011ferlendirir ve bu de\u011ferlendirme neticesinde eri\u015fim reddedilmi\u015fse 403 ACCESS_DENIED gibi uygun bir HTTP durum kodu d\u00f6nd\u00fcr\u00fcr. Yok e\u011fer eri\u015fime izin verilmi\u015fse API Gateway ilgili lambda function’\u0131 tetikler.\n<\/li>\n<\/ul>\n
T\u00fcm bu s\u00fcre\u00e7te lambda authorizer ayarlar\u0131nda \u00f6nbelle\u011fe alma(caching) etkinle\u015ftirildiyse e\u011fer API Gateway bu policy’i \u00f6nbelle\u011fe alacakt\u0131r ve b\u00f6ylece bir sonraki request’te lambda authorizer s\u00fcrecinin yeniden \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131na gerek kal\u0131nmayacakt\u0131r.<\/p>\n
.NET \u0130le Lambda Authorizer Kullan\u0131m\u0131<\/h5>\n
\u015eimdi .NET ile lambda authorizer kullan\u0131m\u0131n\u0131 pratiksel olarak inceliyor olaca\u011f\u0131z. Bunun i\u00e7in \u00f6rnek olarak bir \u00f6nceki .NET \u0130le Amazon API Gateway \u2013 AWS Lambda & DynamoDB Entegrasyonu<\/a> ba\u015fl\u0131kl\u0131 makalede olu\u015fturdu\u011fumuz \u015fu<\/a> projeyi temel olarak baz al\u0131yor olaca\u011f\u0131z.(\u0130lgili makaledeki \u00e7al\u0131\u015fmay\u0131 bu i\u00e7eri\u011fimiz i\u00e7in ben deniz ba\u015ftan sona farkl\u0131 bir projede tekrar geli\u015ftirmi\u015f bulunuyorum. Bu i\u00e7erikle birlikte geli\u015ftirilmi\u015f nihai projeyi makalemizin sonundaki github adresinden edinebilirsiniz.)<\/span><\/p>\n
Bir API Gateway’in t\u00fcm endpoint’lerine tek bir Lambda Authorizer eklenebilece\u011fi gibi her bir endpoint i\u00e7in ayr\u0131 Lambda Authorizer’da olu\u015fturulabilir. Bu tamamen sizlerin tercihine, kullan\u0131m durumuna ve i\u015fin gere\u011fine ba\u011fl\u0131d\u0131r.<\/em><\/p><\/blockquote>\n
Altyap\u0131 projemizdeki genel davran\u0131\u015f\u0131 h\u0131zl\u0131ca an\u0131msarsak e\u011fer; ‘persons’ ad\u0131nda bir DynamoDB tablosuna veri ekleyen, eklenmi\u015f olan t\u00fcm person’lar\u0131 elde eden ve id bazl\u0131 sorgulama ger\u00e7ekle\u015ftiren \u00fc\u00e7 adet lambda function’\u0131m\u0131z mevcuttur. Ayr\u0131ca bu function’lara d\u0131\u015far\u0131dan eri\u015fim g\u00f6stermemizi sa\u011flayan ve \u00fc\u00e7 adet endpoint’e sahip olan API Gateway tasarlanm\u0131\u015ft\u0131r. \u015eimdi bizler Lambda Authorizer ile bu endpoint’lerin g\u00fcvenli\u011fini sa\u011flamaya \u00e7al\u0131\u015f\u0131yor olaca\u011f\u0131z. Bunun i\u00e7in iki yol benimseyece\u011fiz;<\/p>\n\n\n\n\n\n
1. Yol<\/th>\n 2. Yol<\/th>\n<\/tr>\n<\/thead>\n
Username, password vs. gibi g\u00f6nderilen kimlik bilgilerini(credentials) okuyacak ve bunlar\u0131 do\u011frulayacak bir lambda function geli\u015ftirece\u011fiz. Bu do\u011frulama neticesinde bir JWT d\u00f6nd\u00fcrecek ve client’\u0131 b\u00f6ylece yetkilendirece\u011fiz. Client elde edece\u011fi bu JWT de\u011feri ile request’lerini ger\u00e7ekle\u015ftirecektir.<\/p>\n
Yani anlayaca\u011f\u0131n\u0131z authentication sorumlulu\u011funu \u00fcstlenecek bir uygulama olu\u015fturaca\u011f\u0131z.<\/td>\n
Lambda Authorizer, \u00f6z\u00fcnde authorizer olarak davran\u0131\u015f sergileyen ap ayr\u0131 bir AWS Lambda projesidir. Yani function’d\u0131r. Bu function’\u0131n sorumlulu\u011fu, client’lar taraf\u0131ndan yap\u0131lan istek s\u00fcre\u00e7lerinde taraf\u0131m\u0131za iletilen JWT de\u011ferlerini do\u011frulamakt\u0131r. Bu do\u011frulama neticesinde hedef lambda function tetiklenecek yok e\u011fer do\u011frulama ger\u00e7ekle\u015fmezse Amazon API Gateway taraf\u0131ndan yorumlanabilecek\/anla\u015f\u0131labilecek bir IAM politikas\u0131 d\u00f6nd\u00fcr\u00fclecektir.<\/p>\n
Bu da bir authorization sorumlulu\u011fu \u00fcstlenecek uygulama olacakt\u0131r.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
O halde hadi ba\u015flayal\u0131m…<\/p>\n
Authentication uygulamas\u0131n\u0131 geli\u015ftirme;<\/strong><\/p>\n
\n
Ad\u0131m 1 – (Uygulama Olu\u015fturma)<\/span><\/em>
\nSolution i\u00e7erisinde authentication i\u015flemlerini \u00fcstlenmesi i\u00e7in AWS.Lambda.Authorizer.Example.Authentication<\/em> ad\u0131nda bir ‘Empty Function’ olu\u015ftural\u0131m.\n<\/li>\n
Ad\u0131m 2 – (User Modelini Olu\u015fturma)<\/span><\/em>
\nDo\u011frulama s\u00fcrecinde kullan\u0131c\u0131 bilgilerini tutmak i\u00e7in bir model tasarlayal\u0131m.<\/p>\n
\n
\r\n [DynamoDBTable("users")]\r\n public class User\r\n {\r\n [DynamoDBHashKey("email"), DynamoDBProperty("email")]\r\n [JsonPropertyName("email")]\r\n public string? Email { get; set; }\r\n [DynamoDBProperty("username")]\r\n [JsonPropertyName("username")]\r\n public string? Username { get; set; }\r\n [DynamoDBProperty("password")]\r\n [JsonPropertyName("password")]\r\n public string? Password { get; set; }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n
Ad\u0131m 3 – DynamoDB’de Tablo Olu\u015fturma<\/span><\/em>
\nTasarlanan modele uygun DynamoDB’de tablo olu\u015ftural\u0131m. $\".NET$ <\/a>\n<\/li>\n
Ad\u0131m 4 – Token Generate Etme<\/span><\/em>
\nKullan\u0131c\u0131 bilgilerini do\u011frulad\u0131ktan sonra token \u00fcretimini ger\u00e7ekle\u015ftirecek servisi tasarlayal\u0131m.<\/p>\n
\n
\r\n public interface ITokenGenerator\r\n {\r\n string GenerateJWT(User user, int minute);\r\n }\r\n<\/pre>\n<\/div>\n
\n
\r\n public class TokenGenerator : ITokenGenerator\r\n {\r\n public string GenerateJWT(User user, int minute)\r\n {\r\n List<Claim> claims = new() {\r\n new(ClaimTypes.Email, user.Email),\r\n new(ClaimTypes.Name,user.Username)\r\n };\r\n\r\n byte[] secretKey = Encoding.UTF8.GetBytes("doldur be meyhaneci, bo\u015f kalmas\u0131n kadehim...");\r\n\r\n SigningCredentials credentials = new(\r\n key: new SymmetricSecurityKey(secretKey),\r\n algorithm: SecurityAlgorithms.HmacSha256);\r\n\r\n JwtSecurityToken token = new(\r\n claims: claims,\r\n expires: DateTime.UtcNow.AddMinutes(minute),\r\n signingCredentials: credentials);\r\n\r\n JwtSecurityTokenHandler tokenHandler = new();\r\n return tokenHandler.WriteToken(token);\r\n }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n
Ad\u0131m 5 – GenerateTokenAsync Function’\u0131n\u0131 Tasarlama<\/span><\/em>
\nBu ad\u0131mda da olu\u015fturdu\u011fumuz ‘TokenGenerator’ s\u0131n\u0131f\u0131n\u0131 kullanarak gerekli JWT \u00fcretimini ger\u00e7ekle\u015ftirecek function’\u0131 tasarlayal\u0131m.<\/p>\n
\n
\r\nusing Amazon.DynamoDBv2;\r\nusing Amazon.DynamoDBv2.DataModel;\r\nusing Amazon.Lambda.APIGatewayEvents;\r\nusing Amazon.Lambda.Core;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Models;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Services;\r\nusing AWS.Lambda.Authorizer.Example.Authentication.Services.Abstractions;\r\nusing Microsoft.Extensions.DependencyInjection;\r\nusing System.Text.Json;\r\n\r\n\/\/ Assembly attribute to enable the Lambda function's JSON input to be converted into a .NET class.\r\n[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]\r\n\r\nnamespace AWS.Lambda.Authorizer.Example.Authentication;\r\n\r\npublic class Function\r\n{\r\n readonly IServiceProvider _serviceProvider;\r\n public Function()\r\n {\r\n ServiceCollection serviceCollection = new();\r\n serviceCollection.AddScoped<ITokenGenerator, TokenGenerator>();\r\n _serviceProvider = serviceCollection.BuildServiceProvider();\r\n }\r\n public async Task<string> GenerateTokenAsync(APIGatewayHttpApiV2ProxyRequest request, ILambdaContext context)\r\n {\r\n User? user = JsonSerializer.Deserialize<User>(request.Body);\r\n AmazonDynamoDBClient dynamoDBClient = new();\r\n DynamoDBContext dynamoDBContext = new(dynamoDBClient);\r\n\r\n User hasUser = await dynamoDBContext.LoadAsync<User>(user.Email);\r\n if (hasUser != null)\r\n {\r\n if (hasUser.Password != user.Password)\r\n throw new Exception("Invalid credentials!");\r\n\r\n using (IServiceScope scope = _serviceProvider.CreateScope())\r\n {\r\n ITokenGenerator tokenGenerator = scope.ServiceProvider.GetService<ITokenGenerator>();\r\n return tokenGenerator.GenerateJWT(user, 3);\r\n }\r\n }\r\n throw new Exception("User not found!");\r\n }\r\n}\r\n\r\n<\/pre>\n<\/div>\n<\/li>\n
Ad\u0131m 5 – Function’\u0131 Publish Etme ve DynamoDB Eri\u015fim Politikas\u0131yla E\u015fle\u015ftirme<\/span><\/em>
\n\u015eimdide olu\u015fturdu\u011fumuz function’\u0131 publish edelim. $\".NET$ <\/a> $\".NET$ <\/a>
\nFunction’\u0131 publish ettikten sonra AWS Lambda servisinden yandaki gibi kontrol etmenizde fayda vard\u0131r. \u015eimdi bu lambda function ile DynamoDB aras\u0131nda ili\u015fki kuraca\u011f\u0131z. Bunun i\u00e7in IAM Service \u00fczerinden politikalara geliniz ve t\u00fcm aksiyonlar e\u015fli\u011finde DynamoDB eri\u015fim iznine sahip olan politikay\u0131 ilgili lambda function’la ili\u015fkilendiriniz. $\".NET$ <\/a> $\".NET$ <\/a>\n<\/li>\n
Ad\u0131m 6 – API Gateway \u0130le Endpoint Alma<\/span><\/em>
\nVe nihai olarak art\u0131k function’a eri\u015fip, authentication i\u015flemlerini ba\u015far\u0131yla ger\u00e7ekle\u015ftirebilmek i\u00e7in bir API Gateway \u00fczerinden endpoint ayarlayal\u0131m. Tabi burada isterseniz mevcut API Gateway’lerden birini kullanabilir yahut s\u0131rf bu i\u015flem i\u00e7in ba\u015fl\u0131 ba\u015f\u0131na bir API Gateway olu\u015fturabilirsiniz. Ben genel anlamda endpoint’in origin’i de\u011fi\u015fmemesi i\u00e7in var olan bir API Gateway \u00fczerinden bu function’a \u00f6zel bir entegrasyonda bulunaca\u011f\u0131m. Bunun i\u00e7in API Gateway servisinde a\u015fa\u011f\u0131daki g\u00f6rseldeki gibi davran\u0131\u015f sergilenmesi yeterli olacakt\u0131r.
\n $\".NET$ <\/a>G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere yeni ekledi\u011fimiz function’\u0131 API Gateway ile ili\u015fkilendirdik. Bu i\u015flemin ard\u0131ndan a\u015fa\u011f\u0131daki gibi endpoint tan\u0131mlamas\u0131nda bulunabiliriz. $\".NET$ <\/a>\n<\/li>\n
Ad\u0131m 7 – Test<\/span><\/em>
\nVe son olarak olu\u015fturdu\u011fumuz endpoint \u00fczerinden token talebinde bulunabiliriz.
\n $\".NET$ <\/a>\n<\/li>\n<\/ul>\n
Evet, g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere authentication uygulamas\u0131n\u0131 ba\u015far\u0131yla geli\u015ftirmi\u015f bulunuyoruz. \u015eimdi s\u0131ra authorization uygulamas\u0131nda…<\/p>\n
Authorization(Lambda Authorizer) uygulamas\u0131n\u0131 geli\u015ftirme;<\/strong><\/p>\n
\n
Ad\u0131m 1 – Uygulama Olu\u015fturma<\/span><\/em>
\nYine ilk olarak ayn\u0131 solution i\u00e7erisinde bu sefer de authorization i\u015flemlerini \u00fcstlenmesi i\u00e7in AWS.Lambda.Authorizer.Example.Authorization<\/em> ad\u0131nda bir proje olu\u015ftural\u0131m.\n<\/li>\n
Ad\u0131m 2 – Token’\u0131 Do\u011frulama<\/span><\/em>
\nAuthentication uygulamas\u0131ndan al\u0131nm\u0131\u015f olan token’\u0131 do\u011frulamak i\u00e7in gerekli servisi olu\u015ftural\u0131m.<\/p>\n
\n
\r\n public interface ITokenValidator\r\n {\r\n ClaimsPrincipal ValidateToken(string accessToken);\r\n }\r\n<\/pre>\n<\/div>\n
\n
\r\n public class TokenValidator : ITokenValidator\r\n {\r\n public ClaimsPrincipal ValidateToken(string accessToken)\r\n {\r\n JwtSecurityTokenHandler tokenHandler = new();\r\n\r\n byte[] secretKey = Encoding.UTF8.GetBytes("doldur be meyhaneci, bo\u015f kalmas\u0131n kadehim...");\r\n\r\n TokenValidationParameters validationParameters = new()\r\n {\r\n ValidateLifetime = true,\r\n ValidateAudience = false,\r\n ValidateIssuer = false,\r\n IssuerSigningKey = new SymmetricSecurityKey(secretKey),\r\n };\r\n\r\n\r\n try\r\n {\r\n ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(\r\n token: accessToken,\r\n validationParameters: validationParameters,\r\n validatedToken: out SecurityToken _);\r\n return claimsPrincipal;\r\n }\r\n catch (Exception ex)\r\n {\r\n return null;\r\n }\r\n }\r\n }\r\n<\/pre>\n<\/div>\n<\/li>\n
Ad\u0131m 3 – ValidateToken Function’\u0131n\u0131 Tasarlama<\/span><\/em>
\n\u015eimdi de olu\u015fturdu\u011fumuz ‘TokenValidator’ s\u0131n\u0131f\u0131n\u0131 kullanarak token’\u0131 do\u011frulayacak olan function’\u0131 olu\u015ftural\u0131m.<\/p>\n
\n
\r\nusing Amazon.Lambda.APIGatewayEvents;\r\nusing Amazon.Lambda.Core;\r\nusing AWS.Lambda.Authorizer.Example.Authorization.Services;\r\nusing AWS.Lambda.Authorizer.Example.Authorization.Services.Abstractions;\r\nusing Microsoft.Extensions.DependencyInjection;\r\nusing System.Security.Claims;\r\nusing System.Text.Json;\r\n\r\n\/\/ Assembly attribute to enable the Lambda function's JSON input to be converted into a .NET class.\r\n[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]\r\n\r\nnamespace AWS.Lambda.Authorizer.Example.Authorization;\r\n\r\npublic class Function\r\n{\r\n readonly IServiceProvider _serviceProvider;\r\n public Function()\r\n {\r\n ServiceCollection serviceCollection = new();\r\n serviceCollection.AddScoped<ITokenValidator, TokenValidator>();\r\n _serviceProvider = serviceCollection.BuildServiceProvider();\r\n }\r\n public APIGatewayCustomAuthorizerResponse TokenValidator(APIGatewayCustomAuthorizerRequest request, ILambdaContext context)\r\n {\r\n string accessToken = request.Headers["authorization"];\r\n ITokenValidator tokenValidator = _serviceProvider.GetRequiredService<ITokenValidator>();\r\n ClaimsPrincipal claimsPrincipal = tokenValidator.ValidateToken(accessToken);\r\n\r\n string? principalId = "401";\r\n if (claimsPrincipal is { Identity.IsAuthenticated: true })\r\n principalId = claimsPrincipal.FindFirst(ClaimTypes.Name)?.Value;\r\n\r\n return new APIGatewayCustomAuthorizerResponse()\r\n {\r\n PrincipalID = principalId,\r\n PolicyDocument = new APIGatewayCustomAuthorizerPolicy\r\n {\r\n Statement = new List<APIGatewayCustomAuthorizerPolicy.IAMPolicyStatement>\r\n {\r\n new APIGatewayCustomAuthorizerPolicy.IAMPolicyStatement()\r\n {\r\n Effect = claimsPrincipal != null ? "Allow" : "Deny",\r\n Resource = new HashSet<string>{ "arn:aws:execute-api:ap-south-1:567921601443:uyv8v6df12\/\/" },\r\n Action = new HashSet<string>{ "execute-api:Invoke" }\r\n }\r\n }\r\n }\r\n };\r\n }\r\n}\r\n<\/pre>\n<\/div>\n
Evet, olu\u015fturulan function’\u0131n detaylar\u0131ndan bahsetmemiz gerekti\u011fi a\u015fikar. O halde ilk olarak APIGatewayCustomAuthorizerRequest<\/code> ve APIGatewayCustomAuthorizerResponse<\/code> olmak \u00fczere parametre ve geri d\u00f6n\u00fc\u015f t\u00fcrlerini ele alarak ba\u015flayal\u0131m. Bu referanslar, Lambda Authorizer i\u00e7in kullan\u0131lan \u00f6zel s\u0131n\u0131flard\u0131r. APIGatewayCustomAuthorizerRequest<\/code> s\u0131n\u0131f\u0131 JWT do\u011frulamak i\u00e7in gelen istekleri temsil ederken bizlere bu istekle ilgili headers, query string ve di\u011fer bilgileri getirmektedir. Ayn\u0131 \u015fekilde APIGatewayCustomAuthorizerResponse<\/code> s\u0131n\u0131f\u0131 ise yetkilendirme neticesinde gerekli bilgileri i\u00e7erecek olan (ad\u0131 \u00fczerinde) response’u temsil etmektedir.<\/p>\n
APIGatewayCustomAuthorizerResponse<\/code> nesnesinin property’lerine gelirsek e\u011fer; PrincipalID<\/code> property’si, JWT do\u011fruland\u0131\u011f\u0131 taktirde ‘name’ claim’inin de\u011ferini, yok e\u011fer do\u011frulanmazsa “401” de\u011ferini almaktad\u0131r. PolicyDocument<\/code> property’si, APIGatewayCustomAuthorizerPolicy<\/code> t\u00fcr\u00fcnden nesne alan bu property lambda authorizer taraf\u0131ndan API Gateway’e g\u00f6nderilen ve yetkilendirmenin ba\u015far\u0131l\u0131 olup olmad\u0131\u011f\u0131n\u0131 ifade edecek olan yan\u0131t ama\u00e7l\u0131 kullan\u0131lmaktad\u0131r. Bu nesnenin de ‘Effect’, ‘Resource’ ve ‘Action’ property’leri mevcuttur. Bu property’lerden; ‘Effect’, yetkilendirmenin ba\u015far\u0131l\u0131 olup olmad\u0131\u011f\u0131n\u0131 ifade etmektedir. \u00d6rnekte de g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere ba\u015far\u0131l\u0131ysa ‘Allow’ de\u011filse ‘Deny’ de\u011ferlerini almaktad\u0131r. ‘Resource’, i\u015flem yap\u0131lacak kayna\u011f\u0131n ad\u0131n\u0131 temsil etmektedir. ‘Action’ ise i\u015flem yap\u0131lacak kayna\u011f\u0131n \u00fczerinde yap\u0131lacak eylemi\/i\u015flemi temsil etmektedir.<\/p>\n
`Tabi burada ‘Resource’ property’sine biraz daha odaklanmam\u0131z gerekmektedir. ‘Resource’, yap\u0131sal olarak bir ARN(Amazon Resource Name) format\u0131nda de\u011fer beklemektedir. ARN’ler AWS’de ki kaynaklar\u0131n benzersiz tan\u0131mlay\u0131c\u0131s\u0131d\u0131rlar. Misal olarak bir lambda function’\u0131n ARN de\u011feri \u015f\u00f6yle olmal\u0131d\u0131r:<\/p>\n`
\narn:aws:execute-api:<aws-region><\/span>:<aws-account-id><\/span>:<amazon-gateway-id><\/span>\/\/<\/span><\/strong>\n<\/div>\n\n<aws-region><\/span> : AWS servislerinin bulundu\u011fu b\u00f6lgenin de\u011ferini ifade eder.<\/li>\n <aws-account-id><\/span> : AWS Account ID’yi ifade eder. Bu de\u011fer i\u00e7in AWS sayfas\u0131ndan sa\u011f \u00fcst k\u00f6\u015fedeki profilinize t\u0131klaman\u0131z yeterli olacakt\u0131r.<\/a><\/li>\n <amazon-gateway-id><\/span> : API Gateway’in ID de\u011ferini ifade eder. Bu de\u011fer i\u00e7in ise ilgili API Gateway’in detaylar\u0131na bakman\u0131z yeterli olacakt\u0131r.<\/a><\/li>\n<\/ul>\n<\/li>\n Ad\u0131m 4 – Function’\u0131 Publish Etme<\/span><\/em> \nOlu\u015fturulan function’\u0131 publish edelim.<\/a>\n<\/li>\n Ad\u0131m 5 – Endpoint’e Lambda Authorizer Olarak Tan\u0131mlama<\/span><\/em> \nVe son olarak istenilen herhangi bir endpoint’in g\u00fcvenli\u011fini sa\u011flayabilmek i\u00e7in ilgili function’\u0131 o endpoint’e lambda authorizer olarak ekleyelim. Bunun i\u00e7in API Gateway sayfas\u0131nda istedi\u011finiz endpoint’i se\u00e7ebilirsiniz.<\/a>Misal olarak bizler yukar\u0131daki ekran g\u00f6r\u00fcnt\u00fcs\u00fcnde oldu\u011fu gibi GET t\u00fcr\u00fcnden olan ‘\/persons’ endpoint’ine bu function’\u0131 authorizer olarak atamak istedi\u011fimiz taktirde ilgili endpoint’i se\u00e7ip devam\u0131nda sa\u011f taraftaki ‘Attach authorization’ butonuna t\u0131klamal\u0131y\u0131z.<\/a>Ard\u0131ndan ‘Create and attach an authorizer’ butonuna t\u0131klayarak devam edelim.<\/a>Devam\u0131nda ise authorizer type olarak ‘Lambda’ sekmesini se\u00e7elim ve gerekli alanlar\u0131 yukar\u0131daki gibi doldural\u0131m.<\/a>Tasarlad\u0131\u011f\u0131m\u0131z lambda authorizer gelen istekleri do\u011frulamak i\u00e7in IAM politikas\u0131 d\u00f6nd\u00fcrd\u00fc\u011f\u00fcnden dolay\u0131 ‘IAM Policy’ sekmesini se\u00e7elim.<\/a>T\u00fcm bu i\u015flemler neticesinde API Gateway ekran\u0131nda ‘Authorization’ sayfas\u0131na bakt\u0131\u011f\u0131m\u0131zda ilgili endpoint’in ‘Lambda Auth’ ile i\u015faretlendi\u011fini g\u00f6rerek, yetkilendirilmeye tabii tutuldu\u011funu anlayabilmekteyiz.<\/p>\n<\/li>\n Ad\u0131m 6 – Test<\/span><\/em> \nArt\u0131k yapt\u0131\u011f\u0131m\u0131z t\u00fcm bu \u00e7al\u0131\u015fmalar\u0131n nihai testini ger\u00e7ekle\u015ftirebiliriz.<\/a>\n<\/li>\n<\/ul>\nEvet… G\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Lambda Authorizer yap\u0131land\u0131rmas\u0131 i\u015fte bu kadar \ud83d\ude42 K\u0131ssadan hisse yaparsak, bir authentication bir de authorization i\u015flemlerinin sorumlulu\u011funu \u00fcstlenen ayr\u0131 function’lar taraf\u0131ndan rahatl\u0131kla ger\u00e7ekle\u015ftirilebilmekte ve hangi endpoint’i koruyacaksak ilgili authorization uygulamas\u0131 onunla e\u015fle\u015ftirilmektedir.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\nNot : \u00d6rnek projeyi a\u015fa\u011f\u0131daki github adresinden edinebilirsiniz. \nhttps:\/\/github.com\/gncyyldz\/AWS.Lambda.Authorizer.Example<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde, \u00f6nceden .NET 7 \u2013 AWS Lambda \u0130le Serverless Computing ve .NET \u0130le Amazon API Gateway \u2013 AWS Lambda & DynamoDB Entegrasyonu ba\u015fl\u0131klar\u0131 alt\u0131nda kaleme ald\u0131\u011f\u0131m\u0131z makalelerimizde inceledi\u011fimiz AWS Lambda ve Amazon...<\/p>\n","protected":false},"author":1,"featured_media":26163,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4446,4754,2739,4730],"tags":[4769,4773,4771,4772,4766,4770,4767,4768],"class_list":["post-26157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net-6","category-net-7","category-net-core","category-aws","tag-a-request-parameter-based-lambda-authorizer","tag-amazon-resource-name","tag-apigatewaycustomauthorizerrequest","tag-apigatewaycustomauthorizerresponse","tag-lambda-authorizer","tag-request-authorizer","tag-token-authorizer","tag-token-based-lambda-authorizer"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=26157"}],"version-history":[{"count":21,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157\/revisions"}],"predecessor-version":[{"id":26201,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26157\/revisions\/26201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/26163"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=26157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=26157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=26157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}