{"id":3250,"date":"2026-08-17T09:42:30","date_gmt":"2026-08-17T00:42:30","guid":{"rendered":"https:\/\/qol-kk.com\/wp2\/?p=3250"},"modified":"2026-09-07T13:50:48","modified_gmt":"2026-09-07T04:50:48","slug":"20260816-00msvj65","status":"publish","type":"post","link":"https:\/\/qol-kk.com\/wp2\/blog\/2026\/08\/17\/20260816-00msvj65\/","title":{"rendered":"Django\u6a19\u6e96\u306eUser\u30e2\u30c7\u30eb\u3092\u58ca\u3055\u305a\u306bCognito OAuth\u3078\u79fb\u884c\u3059\u308b \u2014 sub\u2194user\u3092\u5225\u30c6\u30fc\u30d6\u30eb\u3067\u7e4b\u3050JIT\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0\u8a2d\u8a08"},"content":{"rendered":"

\u3053\u306e\u8a18\u4e8b\u306b\u3064\u3044\u3066<\/h2>\n

\u500b\u4eba\u958b\u767a\u306e\u3042\u308b\u682a\u5f0f\u5206\u6790Web\u30a2\u30d7\u30ea\u3067\u3001\u8a8d\u8a3c\u57fa\u76e4\u3092\u300cDjango allauth + Simple JWT \u306e\u30e1\u30fc\u30eb\/\u30d1\u30b9\u30ef\u30fc\u30c9\u8a8d\u8a3c\u300d\u304b\u3089\u300cAWS Cognito User Pool \u30d9\u30fc\u30b9\u306e OAuth 2.0 \/ OIDC\u300d\u3078\u79fb\u884c\u3057\u307e\u3057\u305f\u3002\u672c\u7a3f\u306f\u3001\u305d\u306e\u8a2d\u8a08\u5224\u65ad\u3068\u5b9f\u88c5\u306e\u3046\u3061\u3001\u300cDjango\u6a19\u6e96\u306e User<\/code> \u30e2\u30c7\u30eb\u3092\u4e00\u5207\u58ca\u3055\u305a\u306b\u30de\u30cd\u30fc\u30b8\u30c9\u8a8d\u8a3c\u3078\u5bc4\u305b\u308b\u300d<\/strong> \u3053\u3068\u3092\u8ef8\u306b\u307e\u3068\u3081\u305f\u6280\u8853\u8a18\u9332\u3067\u3059\u3002<\/p>\n

\u65e2\u5b58\u30e6\u30fc\u30b6\u30fc\u306e\u30c7\u30fc\u30bf\uff08\u30dd\u30fc\u30c8\u30d5\u30a9\u30ea\u30aa\u30fb\u30c1\u30e3\u30c3\u30c8\u5c65\u6b74\uff09\u30921\u4ef6\u3082\u58ca\u3055\u306a\u3044\u3053\u3068\u304c\u7d76\u5bfe\u6761\u4ef6\u3060\u3063\u305f\u305f\u3081\u3001\u300c\u4e00\u6c17\u306b\u7f6e\u304d\u63db\u3048\u308b\u300d\u9078\u629e\u80a2\u306f\u6700\u521d\u304b\u3089\u6368\u3066\u3066\u3044\u307e\u3059\u3002\u79fb\u884c\u306e\u6838\u5fc3\u306f\u6b21\u306e3\u70b9\u306b\u96c6\u7d04\u3055\u308c\u307e\u3059\u3002<\/p>\n

    \n
  1. auth_user<\/code> \u306b\u30ab\u30e9\u30e0\u3092\u8db3\u3055\u305a\u3001\u5225\u30c6\u30fc\u30d6\u30eb\u3067 Cognito\u306esub<\/code> \u2194 user_id<\/code> \u30921:1\u3067\u7d10\u4ed8\u3051\u308b<\/strong><\/li>\n
  2. \u65e2\u5b58\u30e6\u30fc\u30b6\u30fc\u306f JIT\uff08Just-In-Time\uff09\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0<\/strong>\u3067\u81ea\u52d5\u4fdd\u5168\u3059\u308b<\/li>\n
  3. DRF\u306eAuthentication Class\u3092\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u5316<\/strong>\u3057\u3001\u65e7\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u52d5\u304b\u3057\u305f\u307e\u307e\u6bb5\u968e\u79fb\u884c\u3059\u308b<\/li>\n<\/ol>\n

    \u74b0\u5883<\/h2>\n
      \n
    • \u79fb\u884c\u524d: Django + Django REST Framework\u3001Django\u6a19\u6e96 User<\/code> \u30e2\u30c7\u30eb\uff08\u30ab\u30b9\u30bf\u30e0\u4e0d\u63a1\u7528\uff09\u3001allauth + Simple JWT \u306e\u30e1\u30fc\u30eb\/\u30d1\u30b9\u30ef\u30fc\u30c9\u8a8d\u8a3c\uff08access 30\u5206 \/ refresh 7\u65e5 \/ rotation\u6709\uff09<\/li>\n
    • \u79fb\u884c\u5f8c: AWS Cognito User Pool \u3092\u5358\u4e00\u306e\u8a8d\u8a3c\u57fa\u76e4\u306b\u3002\u30d6\u30e9\u30a6\u30b6SPA \/ \u5916\u90e8LLM\u9023\u643a \/ \u65e2\u5b58\u306e\u9759\u7684Bearer\u30ad\u30fc\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u306e3\u7d4c\u8def\u3092\u96c6\u7d04<\/li>\n
    • \u30c8\u30fc\u30af\u30f3: JWT (RS256) \/ JWKS\u3001\u5b9f\u884c\u74b0\u5883\u306f AWS Lambda\uff08\u30b9\u30c6\u30fc\u30c8\u30ec\u30b9\uff09\u3001IaC \u306f Terraform<\/li>\n<\/ul>\n

      \u306a\u305c\u79fb\u884c\u3057\u305f\u304b<\/h2>\n

      \u30e1\u30fc\u30eb\/\u30d1\u30b9\u30ef\u30fc\u30c9\u8a8d\u8a3c\u306f\u52d5\u3044\u3066\u3044\u307e\u3057\u305f\u304c\u30013\u3064\u306e\u8981\u6c42\u306b\u5fdc\u3048\u3089\u308c\u306a\u304f\u306a\u3063\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n

        \n
      • \u5916\u90e8LLM\u30b5\u30fc\u30d3\u30b9\u306e\u9023\u643a\u8981\u6c42<\/strong>: \u3042\u308bLLM\u30b5\u30fc\u30d3\u30b9\u306eAgent\/Actions\u9023\u643a\u306e\u5229\u7528\u898f\u7d04\u304c\u3001OAuth\u8a8d\u8a3c\u7d4c\u8def\u3092\u8981\u6c42\u3057\u3066\u304d\u305f<\/li>\n
      • \u5229\u7528\u8005\u306e\u5373\u6642\u7121\u52b9\u5316<\/strong>: \u96e2\u8131\u8005\u30fb\u9000\u8077\u8005\u3092\u904b\u55b6\u5074\u304b\u3089\u5373\u5ea7\u306b\u30ed\u30b0\u30a4\u30f3\u4e0d\u53ef\u306b\u3057\u305f\u3044<\/li>\n
      • \u8a8d\u8a3c\u7d4c\u8def\u306e\u5206\u6563<\/strong>: \u5897\u3048\u3064\u3064\u3042\u308b\u8907\u6570\u306e\u5165\u53e3\u30921\u3064\u306e\u8a8d\u8a3c\u57fa\u76e4\u306b\u96c6\u7d04\u3057\u305f\u3044<\/li>\n<\/ul>\n

        Cognito User Pool \u306f\u3053\u306e3\u3064\u3092\u307e\u3068\u3081\u3066\u89e3\u6c7a\u3067\u304d\u307e\u3059\u3002OIDC\u6e96\u62e0\u3067OAuth\u306e\u5165\u53e3\u3092\u6301\u3061\u3001Disable user<\/code> \/ Sign out user<\/code> \u3067\u5373\u6642\u7121\u52b9\u5316\u3067\u304d\u3001\u8907\u6570App Client\u3067\u7d4c\u8def\u3092\u5206\u3051\u3089\u308c\u307e\u3059\u3002<\/p>\n

        \u8a2d\u8a08\u4e0a\u306e\u843d\u3068\u3057\u7a74 \u2014 \u306a\u305c\u6a19\u6e96User\u3092\u58ca\u3057\u3066\u306f\u3044\u3051\u306a\u3044\u304b<\/h2>\n

        Cognito\u79fb\u884c\u3067\u307e\u305a\u601d\u3044\u3064\u304f\u306e\u306f\u300cauth_user<\/code> \u306b cognito_sub<\/code> \u30ab\u30e9\u30e0\u3092\u8db3\u3057\u3066\u30ab\u30b9\u30bf\u30e0User\u30e2\u30c7\u30eb\u306b\u3059\u308b\u300d\u3067\u3059\u304c\u3001\u7a3c\u50cd\u4e2d\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306e\u30ab\u30b9\u30bf\u30e0User\u30e2\u30c7\u30eb\u79fb\u884c\u306f\u5c48\u6307\u306e\u30cf\u30a4\u30ea\u30b9\u30af\u4f5c\u696d\u3067\u3059\u3002<\/p>\n

          \n
        • AUTH_USER_MODEL<\/code> \u306e\u5dee\u3057\u66ff\u3048\u306f\u30de\u30a4\u30b0\u30ec\u30fc\u30b7\u30e7\u30f3\u5c65\u6b74\u306b\u6df1\u304f\u98df\u3044\u8fbc\u3080<\/li>\n
        • \u65e2\u5b58\u306e\u5916\u90e8\u30ad\u30fc\uff08\u30dd\u30fc\u30c8\u30d5\u30a9\u30ea\u30aa\u30fb\u30c1\u30e3\u30c3\u30c8\u5c65\u6b74\u7b49\uff09\u304c\u5168\u3066 User<\/code> \u3092\u6307\u3059\u305f\u3081\u5dee\u3057\u66ff\u3048\u304c\u9023\u9396\u3059\u308b<\/li>\n
        • allauth \/ admin \/ \u30b5\u30fc\u30c9\u30d1\u30fc\u30c6\u30a3\u304c\u6a19\u6e96 User<\/code> \u524d\u63d0\u3067\u52d5\u304f<\/li>\n<\/ul>\n

          \u300c\u8a8d\u8a3c\u306e\u5165\u53e3\u3092\u5909\u3048\u305f\u3044\u300d\u3060\u3051\u306a\u306e\u306b\u30c7\u30fc\u30bf\u30e2\u30c7\u30eb\u306e\u6839\u5e79\u306b\u624b\u3092\u5165\u308c\u308b\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002\u3053\u3053\u3067\u306e\u8a2d\u8a08\u5224\u65ad\u306f\u660e\u5feb\u3067\u3059\u3002\u6a19\u6e96 User<\/code> \u306f\u4e0d\u53ef\u4fb5\u306b\u3057\u3001Cognito\u306esub\u3068Django\u306euser_id\u306e\u5bfe\u5fdc\u306f\u5225\u30c6\u30fc\u30d6\u30eb\u306b\u9003\u304c\u3059\u3002<\/strong><\/p>\n

          \u5b9f\u88c51: \u30ea\u30f3\u30af\u30c6\u30fc\u30d6\u30eb\u3067 sub \u2194 user_id \u30921:1\u306b\u7d10\u4ed8\u3051\u308b<\/h2>\n

          auth_user<\/code> \u306b\u306f\u89e6\u308c\u305a\u3001\u5225\u30c6\u30fc\u30d6\u30eb\u30921\u679a\u7acb\u3066\u3066IdP\u5074\u306e\u30a2\u30a4\u30c7\u30f3\u30c6\u30a3\u30c6\u30a3\u3092\u6301\u305f\u305b\u307e\u3059\u3002<\/p>\n

          from django.conf import settings\nfrom django.db import models\n\n\nclass IdentityLink(models.Model):\n    \"\"\"Cognito(\u7b49IdP)\u306e\u30a2\u30a4\u30c7\u30f3\u30c6\u30a3\u30c6\u30a3\u3068 Django User \u3092 1:1 \u3067\u7d50\u3076\u3002\n    auth_user \u306b\u306f\u4e00\u5207\u30ab\u30e9\u30e0\u3092\u8db3\u3055\u306a\u3044\u3002\"\"\"\n\n    user = models.OneToOneField(\n        settings.AUTH_USER_MODEL,\n        on_delete=models.CASCADE,\n        related_name=\"identity_link\",\n    )\n    provider = models.CharField(max_length=32, default=\"cognito\")\n    subject = models.CharField(max_length=255, unique=True)  # Cognito\u306esub\n    email = models.EmailField()\n    last_signed_in_at = models.DateTimeField(null=True, blank=True)\n\n    class Meta:\n        constraints = [\n            models.UniqueConstraint(\n                fields=[\"provider\", \"subject\"],\n                name=\"uq_provider_subject\",\n            )\n        ]<\/pre>\n
          \u3053\u306e\u30c6\u30fc\u30d6\u30eb\u306b\u3057\u305f\u7406\u7531\u306f2\u3064\u3067\u3059\u3002\u6a19\u6e96\u30e2\u30c7\u30eb\u306e\u4e0d\u53ef\u4fb5\u5316<\/strong>\uff08\u30ed\u30fc\u30eb\u30d0\u30c3\u30af\u306f\u300c\u30ea\u30f3\u30af\u30c6\u30fc\u30d6\u30eb\u3092\u6d88\u3059\u3060\u3051\u300d\u3067\u6e08\u3080\uff09\u3068\u3001\u5c06\u6765\u306e\u62e1\u5f35<\/strong>\uff081\u30e6\u30fc\u30b6\u30fc\u304c\u8907\u6570IdP\u3092\u6301\u3064\u62e1\u5f35\u3067\u306f provider<\/code> \u3092\u8ef8\u306b\u3057\u305f\u95a2\u9023\u304c\u6700\u521d\u304b\u3089\u5225\u30c6\u30fc\u30d6\u30eb\u304c\u81ea\u7136\u3002OneToOne<\/code> \u3092 ForeignKey<\/code> \u306b\u7de9\u3081\u308c\u30701:N\u3078\u5e83\u3052\u3089\u308c\u308b\uff09\u3002<\/p>\n
          \u5b9f\u88c52: JIT\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0\u3067\u65e2\u5b58\u30e6\u30fc\u30b6\u30fc\u3092\u81ea\u52d5\u4fdd\u5168\u3059\u308b<\/h2>\n
          \u79fb\u884c\u6642\u306e\u4e00\u62ec\u30d0\u30c3\u30c1\u306f\u66f8\u304b\u305a\u3001\u521d\u56de\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u305d\u306e\u5834\u3067\u7d10\u4ed8\u3051\u308b\uff08JIT\uff09<\/strong>\u3002\u89e3\u6c7a\u9806\u5e8f\u304c\u809d\u3067\u3001\u5fc5\u305a\u6b21\u306e\u9806\u3067\u89e3\u304d\u307e\u3059\u3002<\/p>\n
          from django.contrib.auth import get_user_model\nfrom django.utils import timezone\n\nUser = get_user_model()\n\n\ndef resolve_user_from_claims(claims: dict) -> User:\n    \"\"\"\u691c\u8a3c\u6e08\u307fclaims\u304b\u3089 Django User \u3092\u89e3\u6c7a\u3059\u308b\u3002\n    \u2460sub\u691c\u7d22 \u2192 \u2461email\u30de\u30c3\u30c1\u30f3\u30b0 \u2192 \u2462\u65b0\u898f\u4f5c\u6210 \u306e\u9806\u3002\"\"\"\n\n    sub = claims[\"sub\"]\n    email = claims.get(\"email\", \"\").lower()\n\n    # \u2460 \u65e2\u5b58\u30ea\u30f3\u30af\u3092 sub \u3067\u691c\u7d22\uff082\u56de\u76ee\u4ee5\u964d\u306f\u3053\u3053\u3067\u5373\u30d2\u30c3\u30c8\uff09\n    link = IdentityLink.objects.filter(\n        provider=\"cognito\", subject=sub\n    ).select_related(\"user\").first()\n    if link:\n        link.last_signed_in_at = timezone.now()\n        link.save(update_fields=[\"last_signed_in_at\"])\n        return link.user\n\n    # \u2461 email \u3067\u65e2\u5b58\u30e6\u30fc\u30b6\u30fc\u3092\u5f15\u304d\u5f53\u3066\u308b\uff08\uff1d\u79fb\u884c\u524d\u30e6\u30fc\u30b6\u30fc\u306e\u521d\u56de\u30ed\u30b0\u30a4\u30f3\uff09\n    user = User.objects.filter(email__iexact=email).first()\n\n    # \u2462 \u3069\u3053\u306b\u3082\u5c45\u306a\u3051\u308c\u3070\u65b0\u898f\u4f5c\u6210\uff08Cognito\u7d4c\u7531\u306e\u307f\u30ed\u30b0\u30a4\u30f3\u53ef\u306b\uff09\n    if user is None:\n        user = User.objects.create(username=email, email=email)\n        user.set_unusable_password()  # \u30ed\u30fc\u30ab\u30eb\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u306e\u30ed\u30b0\u30a4\u30f3\u3092\u5c01\u3058\u308b\n        user.save()\n\n    IdentityLink.objects.create(\n        provider=\"cognito\",\n        subject=sub,\n        email=email,\n        user=user,\n        last_signed_in_at=timezone.now(),\n    )\n    return user<\/pre>\n
          \u30dd\u30a4\u30f3\u30c8\u306f\u2461\u306eemail\u30de\u30c3\u30c1\u30f3\u30b0<\/strong>\u3067\u3059\u3002\u79fb\u884c\u524d\u30e6\u30fc\u30b6\u30fc\u306fCognito\u306b\u30b5\u30a4\u30f3\u30a4\u30f3\u3057\u305f\u5f8c\u3001\u521d\u3081\u3066\u30a2\u30af\u30bb\u30b9\u3057\u305f\u77ac\u9593\u306bemail\u3067\u65e2\u5b58 User<\/code> \u3078\u5438\u7740\u3055\u308c\u307e\u3059\u3002\u65e2\u5b58\u306e\u30dd\u30fc\u30c8\u30d5\u30a9\u30ea\u30aa\u3084\u30c1\u30e3\u30c3\u30c8\u5c65\u6b74\u306f User<\/code> \u306b\u7d10\u4ed8\u3044\u305f\u307e\u307e\u306a\u306e\u30671\u4ef6\u3082\u6b20\u3051\u307e\u305b\u3093\u3002\u65b0\u898f\u4f5c\u6210\u6642\u306e set_unusable_password()<\/code> \u3067\u300cCognito\u7d4c\u7531\u3067\u306e\u307f\u30ed\u30b0\u30a4\u30f3\u53ef\u80fd\u300d\u306b\u3057\u3001\u65e7\u30d1\u30b9\u30ef\u30fc\u30c9\u30ed\u30b0\u30a4\u30f3\u7d4c\u8def\u3068\u6df7\u7dda\u3055\u305b\u307e\u305b\u3093\u3002<\/p>\n
          \u306a\u304a\u3001email\u30de\u30c3\u30c1\u30f3\u30b0\u306b\u3088\u308b\u81ea\u52d5\u5438\u7740\u306f email_verified<\/code> \u304c\u4fdd\u8a3c\u3055\u308c\u3066\u3044\u308b\u524d\u63d0\u3067\u306e\u307f\u5b89\u5168\u3067\u3059\u3002\u672a\u691c\u8a3c\u30e1\u30fc\u30eb\u3067\u5438\u7740\u3092\u8a31\u3059\u3068\u4ed6\u4eba\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4e57\u3063\u53d6\u308c\u307e\u3059\u3002\u691c\u8a3c\u306f\u6b21\u306e\u30c8\u30fc\u30af\u30f3\u691c\u8a3c\u5c64\u3067\u5fc5\u305a\u62c5\u4fdd\u3057\u307e\u3059\u3002<\/p>\n
          \u5b9f\u88c53: DRF\u8a8d\u8a3c\u3092\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u5316\u3057\u3066\u6bb5\u968e\u79fb\u884c\u3059\u308b<\/h2>\n
          \u8a8d\u8a3c\u3092\u4e00\u6669\u3067\u5207\u308a\u66ff\u3048\u308b\u3068\u65e2\u5b58\u306e\u9759\u7684Bearer\u30ad\u30fc\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u304c\u6b62\u307e\u308a\u307e\u3059\u3002\u305d\u3053\u3067 DEFAULT_AUTHENTICATION_CLASSES<\/code> \u306b\u65b0\u65e72\u3064\u3092\u4e26\u3079\u3001\u9806\u756a\u306b\u8a66\u3057\u307e\u3059<\/strong>\u3002<\/p>\n
          from rest_framework.authentication import BaseAuthentication\nfrom rest_framework import exceptions\n\n\nclass CognitoJWTAuthentication(BaseAuthentication):\n    def authenticate(self, request):\n        raw = _extract_bearer(request)\n        if raw is None:\n            return None  # \u6b21\u306eAuthentication Class\u3078\u59d4\u8b72\n        if raw.startswith(\"svc_key_\"):  # \u9759\u7684\u30ad\u30fc\u306a\u3089\u65e7\u65b9\u5f0f\u3078\u59d4\u8b72\n            return None\n        claims = verify_cognito_access_token(raw)\n        user = resolve_user_from_claims(claims)\n        return (user, claims)\n\n\nclass LegacyStaticKeyAuthentication(BaseAuthentication):\n    \"\"\"\u65e2\u5b58\u306e\u9759\u7684Bearer\u30ad\u30fc\uff08\u30b5\u30fc\u30d3\u30b9\u56fa\u6709\u30d7\u30ec\u30d5\u30a3\u30c3\u30af\u30b9\u4ed8\u304d\uff09\u306e\u5f8c\u65b9\u4e92\u63db\u5c64\u3002\"\"\"\n    def authenticate(self, request):\n        raw = _extract_bearer(request)\n        if raw is None or not raw.startswith(\"svc_key_\"):\n            return None\n        user = lookup_user_by_static_key(raw)\n        if user is None:\n            raise exceptions.AuthenticationFailed(\"invalid key\")\n        return (user, None)<\/pre>\n
          # settings.py\nREST_FRAMEWORK = {\n    \"DEFAULT_AUTHENTICATION_CLASSES\": [\n        \"myapp.auth.CognitoJWTAuthentication\",       # \u65b0\u65b9\u5f0f\u3092\u5148\u306b\n        \"myapp.auth.LegacyStaticKeyAuthentication\",  # \u65e7\u65b9\u5f0f\u306b\u30d5\u30a9\u30fc\u30eb\u30d0\u30c3\u30af\n    ],\n}<\/pre>\n
          authenticate()<\/code> \u304c None<\/code> \u3092\u8fd4\u3059\u3068DRF\u306f\u6b21\u306e\u30af\u30e9\u30b9\u3078\u30d5\u30a9\u30fc\u30eb\u30d0\u30c3\u30af\u3057\u307e\u3059\u3002\u30ad\u30fc\u5f62\u5f0f\u306e\u30d7\u30ec\u30d5\u30a3\u30c3\u30af\u30b9\u3067\u632f\u308a\u5206\u3051\u308b<\/strong>\u3053\u3068\u3067\u3001Cognito\u306eJWT\u306a\u3089\u65b0\u65b9\u5f0f\u3001svc_key_...<\/code> \u306a\u3089\u65e7\u65b9\u5f0f\u3068\u81ea\u7136\u306b\u5206\u5c90\u3057\u307e\u3059\u3002\u65e7\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306f\u7121\u6539\u4fee\u3067\u52d5\u304d\u7d9a\u3051\u3001\u65e7\u7d4c\u8def\u306e\u5ec3\u6b62\u306f\u79fb\u884c\u5b8c\u4e86\u5f8c\u306b410 Gone\u3067\u6700\u5f8c\u306b\u843d\u3068\u3057\u307e\u3059\u3002<\/p>\n
          \u5b9f\u88c54: JWT\u691c\u8a3c\u5c64 \u2014 \u30c1\u30a7\u30c3\u30af\u3059\u3079\u304dclaim\u3092\u59a5\u5354\u3057\u306a\u3044<\/h2>\n
          \u30c8\u30fc\u30af\u30f3\u691c\u8a3c\u3092\u7518\u304f\u3059\u308b\u3068\u2461\u306eemail\u30de\u30c3\u30c1\u30f3\u30b0\u304c\u51f6\u5668\u306b\u5909\u308f\u308a\u307e\u3059\u3002access token\u3067\u6700\u4f4e\u9650\u78ba\u8a8d\u3059\u308bclaim\u306f\u4ee5\u4e0b\u3067\u3059\u3002<\/p>\n
          import jwt  # PyJWT\n\nALLOWED_CLIENT_IDS = {\"<spa_client_id>\", \"<confidential_client_id>\"}\nISSUER = \"https:\/\/cognito-idp.ap-northeast-1.amazonaws.com\/ap-northeast-1_XXXXXXXXX\"\n\n\ndef verify_cognito_access_token(raw: str) -> dict:\n    header = jwt.get_unverified_header(raw)\n    key = get_signing_key(header[\"kid\"])\n\n    claims = jwt.decode(\n        raw, key=key, algorithms=[\"RS256\"], issuer=ISSUER,\n        options={\"require\": [\"exp\", \"iss\", \"token_use\"]},\n    )\n\n    if claims.get(\"iss\") != ISSUER:\n        raise exceptions.AuthenticationFailed(\"bad issuer\")\n    if claims.get(\"token_use\") != \"access\":       # id token\u3092\u8aa4\u53d7\u3057\u306a\u3044\n        raise exceptions.AuthenticationFailed(\"not an access token\")\n    if claims.get(\"client_id\") not in ALLOWED_CLIENT_IDS:\n        raise exceptions.AuthenticationFailed(\"client_id not allowed\")\n    if claims.get(\"email_verified\") is False:     # \u30e1\u30fc\u30eb\u4e57\u3063\u53d6\u308a\u9632\u6b62\n        raise exceptions.AuthenticationFailed(\"email not verified\")\n\n    return claims<\/pre>\n
          issuer\u5b8c\u5168\u4e00\u81f4\u30fbtoken_use=access\u30fbclient_id\u8a31\u53ef\u30ea\u30b9\u30c8\u30fb\u6709\u52b9\u671f\u9650\u30fbemail_verified=false<\/code>\u62d2\u5426\u3002\u6700\u5f8c\u306e\u3072\u3068\u3064\u304c\u3001JIT\u306eemail\u30de\u30c3\u30c1\u30f3\u30b0\u3092\u5b89\u5168\u306b\u3059\u308b\u6700\u5f8c\u306e\u7826\u3067\u3059\u3002<\/p>\n
          \u5b9f\u88c55: JWKS\u30ad\u30e3\u30c3\u30b7\u30e5 \u2014 Lambda\u3067\u3082\u30ed\u30fc\u30ab\u30eb\u30e1\u30e2\u30ea\u3067\u5341\u5206<\/h2>\n
          RS256\u691c\u8a3c\u306b\u306f\u516c\u958b\u9375\uff08JWKS\uff09\u304c\u5fc5\u8981\u3067\u3059\u3002\u65b9\u91dd\u306f\u300cTTL 1h\u306e\u30ed\u30fc\u30ab\u30eb\u30e1\u30e2\u30ea\u30ad\u30e3\u30c3\u30b7\u30e5 + kid\u4e0d\u4e00\u81f4\u6642\u306e\u5f37\u5236\u518d\u53d6\u5f97<\/strong>\u300d\u3002<\/p>\n
          _JWKS_CACHE = {\"keys\": {}, \"fetched_at\": 0}\n_TTL = 3600\n\n\ndef get_signing_key(kid: str):\n    now = _now()\n    # TTL\u5207\u308c\u3001\u307e\u305f\u306f\u672a\u77e5\u306ekid\uff08\uff1d\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u76f4\u5f8c\uff09\u306f\u53d6\u308a\u76f4\u3059\n    if (now - _JWKS_CACHE[\"fetched_at\"] > _TTL) or (kid not in _JWKS_CACHE[\"keys\"]):\n        _JWKS_CACHE[\"keys\"] = _fetch_jwks()\n        _JWKS_CACHE[\"fetched_at\"] = now\n    key = _JWKS_CACHE[\"keys\"].get(kid)\n    if key is None:\n        raise exceptions.AuthenticationFailed(\"unknown kid\")\n    return key<\/pre>\n
          kid\u304c\u672a\u77e5\u306a\u3089\u5373\u518d\u53d6\u5f97\u3059\u308b<\/strong>\u306e\u304c\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u8ffd\u5f93\u306e\u52d8\u6240\u3067\u3059\u3002Lambda\u306f\u30b9\u30c6\u30fc\u30c8\u30ec\u30b9\u3067\u3059\u304c\u3001\u30b3\u30f3\u30c6\u30ca\u306e\u751f\u5b58\u671f\u9593\u4e2d\u306f\u3053\u306e\u30ed\u30fc\u30ab\u30eb\u30e1\u30e2\u30ea\u30ad\u30e3\u30c3\u30b7\u30e5\u304c\u30d2\u30c3\u30c8\u3059\u308b\u305f\u3081\u3001Redis\u306e\u3088\u3046\u306a\u5916\u90e8\u30ad\u30e3\u30c3\u30b7\u30e5\u306f\u5f53\u9762\u4e0d\u8981\u3067\u3057\u305f\u3002<\/p>\n
          \u5b9f\u88c56: App Client\u30922\u3064\u306b\u5206\u3051\u308b<\/h2>\n\n\n\n\n\n\n
          \u7528\u9014<\/th>\n\u7a2e\u5225<\/th>\nsecret<\/th>\nPKCE<\/th>\ncallback URL<\/th>\n<\/tr>\n<\/thead>\n
          \u30d6\u30e9\u30a6\u30b6SPA<\/td>\npublic client<\/td>\n\u306a\u3057<\/td>\n\u5fc5\u9808<\/td>\nhttps:\/\/app.example.com\/callback<\/code><\/td>\n<\/tr>\n
          \u5916\u90e8LLM\u9023\u643a<\/td>\nconfidential client<\/td>\n\u3042\u308a<\/td>\n\u2014<\/td>\n\u9023\u643a\u30b5\u30fc\u30d3\u30b9\u5074\u306eURL<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
          \u5206\u3051\u308b\u7406\u7531\u306f\u3001secret\u6f0f\u6d29\u9632\u6b62<\/strong>\uff08SPA\u306f\u30b3\u30fc\u30c9\u304c\u9732\u51fa\u3059\u308b\u306e\u3067secret\u3092\u6301\u3066\u306a\u3044\uff09\u3001callback URL\u5206\u96e2<\/strong>\uff08\u623b\u308a\u5148\u304c\u5168\u304f\u7570\u306a\u308b\u3002\u540c\u5c45\u306f\u30aa\u30fc\u30d7\u30f3\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306e\u6e29\u5e8a\uff09\u3001\u30e9\u30a4\u30d5\u30b5\u30a4\u30af\u30eb\/\u76e3\u67fb\u306e\u72ec\u7acb<\/strong>\uff08\u7247\u65b9\u3060\u3051\u5931\u52b9\u30fb\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u3067\u304d\u308b\uff09\u3067\u3059\u3002<\/p>\n
          \u5229\u7528\u8005\u306e\u5373\u6642\u7121\u52b9\u5316<\/h2>\n
          \u30de\u30cd\u30fc\u30b8\u30c9\u8a8d\u8a3c\u306b\u5bc4\u305b\u305f\u6700\u5927\u306e\u5b9f\u5229\u3067\u3059\u3002Disable user<\/code> \u3067\u5373\u5ea7\u306b\u65b0\u898f\u30ed\u30b0\u30a4\u30f3\u4e0d\u53ef\uff08\u65e2\u767a\u884caccess token\u306f\u6700\u95771h\u751f\u5b58\uff09\u3001Sign out user<\/code> \u3067refresh token\u3082\u7121\u52b9\u5316\u3002\u3053\u306e2\u3064\u3067\u5168\u7d4c\u8def\u304c\u540c\u6642\u306b\u9589\u3058\u307e\u3059\u3002\u81ea\u524d\u5b9f\u88c5\u3060\u3068\u5404\u7d4c\u8def\u3054\u3068\u306b\u5931\u52b9\u30ed\u30b8\u30c3\u30af\u3092\u66f8\u304f\u5fc5\u8981\u304c\u3042\u308a\u307e\u3057\u305f\u3002<\/p>\n
          \u78ba\u8a8d\u65b9\u6cd5<\/h2>\n
            \n
          • \u79fb\u884c\u524d\u30e6\u30fc\u30b6\u30fc\u306e\u521d\u56de\u30ed\u30b0\u30a4\u30f3\u3067\u30c7\u30fc\u30bf\u304c\u6b20\u3051\u305a\u306b\u7d10\u4ed8\u304d\u3001User<\/code> \u304c\u65b0\u898f\u4f5c\u6210\u3055\u308c\u306a\u3044\u3053\u3068<\/li>\n
          • 2\u56de\u76ee\u4ee5\u964d\u306fsub\u691c\u7d22\u3067\u5373\u30d2\u30c3\u30c8\u3059\u308b\u3053\u3068<\/li>\n
          • \u65e7\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\uff08svc_key_...<\/code>\uff09\u304c\u7121\u6539\u4fee\u3067\u901a\u308a\u3001Cognito JWT\u3067\u3082\u540c\u4e00\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u304c\u901a\u308b\u3053\u3068<\/li>\n
          • token_use=id<\/code> \/ \u5225issuer \/ \u672a\u8a31\u53efclient_id \/ email_verified=false<\/code> \u304c401\u306b\u306a\u308b\u3053\u3068<\/li>\n
          • \u672a\u77e5kid\u3067JWKS\u518d\u53d6\u5f97\u304c\u8d70\u308b\u3053\u3068<\/li>\n
          • Disable user<\/code> \u5f8c\u306b\u65b0\u898f\u30ed\u30b0\u30a4\u30f3\u4e0d\u53ef\u3001Sign out user<\/code> \u5f8c\u306brefresh\u304c\u5931\u6557\u3059\u308b\u3053\u3068<\/li>\n<\/ul>\n
            \u6ce8\u610f\u70b9<\/h2>\n
              \n
            • email\u30de\u30c3\u30c1\u30f3\u30b0\u306f email_verified<\/code> \u524d\u63d0\u3067\u306e\u307f\u5b89\u5168\u3002\u691c\u8a3c\u5c64\u3067\u672a\u691c\u8a3c\u30e1\u30fc\u30eb\u3092\u5f3e\u304f\u5b9f\u88c5\u3092\u5fc5\u305a\u30bb\u30c3\u30c8\u306b\u3059\u308b<\/li>\n
            • Disable user<\/code> \u306f\u65e2\u767a\u884caccess token\u3092\u5373\u5ea7\u306b\u306f\u6bba\u3055\u306a\u3044\uff08\u6700\u95771h\u6b8b\u308b\uff09<\/li>\n
            • \u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u8a8d\u8a3c\u306f\u6642\u9650\u63aa\u7f6e\u3002\u65e7\u7d4c\u8def\u306f410 Gone\u3067\u660e\u793a\u7684\u306b\u5ec3\u6b62\u3059\u308b<\/li>\n
            • \u6bb5\u968e\u79fb\u884c\u306e\u9806\u5e8f\u306f\u300c\u30a4\u30f3\u30d5\u30e9\u6e96\u5099\uff08Terraform\uff09\u2192 \u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u8a8d\u8a3c\u5c64 \u2192 \u30d5\u30ed\u30f3\u30c8\u6539\u4fee\uff08Amplify Auth\uff09\u2192 \u65e7\u8a8d\u8a3c\u5ec3\u6b62\uff08410 Gone\uff09+ \u5916\u90e8\u9023\u643a\u63a5\u7d9a\u300d\u3002\u30d5\u30ed\u30f3\u30c8\u3092\u89e6\u308b\u524d\u306b\u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u3067\u65b0\u65e7\u4e21\u5bfe\u5fdc\u306b\u3057\u3066\u304a\u304f\u306e\u304c\u30c0\u30a6\u30f3\u30bf\u30a4\u30e0\u3092\u4f5c\u3089\u306a\u3044\u30b3\u30c4<\/li>\n<\/ul>\n
              \u307e\u3068\u3081<\/h2>\n
              Django\u6a19\u6e96\u306e User<\/code> \u3092\u58ca\u3055\u305aCognito\u3078\u79fb\u884c\u3059\u308b\u9375\u306f\u3001auth_user<\/code> \u306b\u89e6\u3089\u305a\u5225\u30c6\u30fc\u30d6\u30eb\u3067 sub<\/code> \u2194 user_id<\/code> \u30921:1\u306b\u7d10\u4ed8\u3051\u308b\u3053\u3068\u3067\u3057\u305f\u3002\u65e2\u5b58\u30e6\u30fc\u30b6\u30fc\u306fJIT\u3067\u521d\u56de\u30ed\u30b0\u30a4\u30f3\u6642\u306b\u81ea\u52d5\u4fdd\u5168\u3067\u304d\u3001DRF\u306e\u30cf\u30a4\u30d6\u30ea\u30c3\u30c9\u8a8d\u8a3c\u3067\u65e7\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u52d5\u304b\u3057\u305f\u307e\u307e\u6bb5\u968e\u79fb\u884c\u3067\u304d\u307e\u3059\u3002App Client\u306fpublic(SPA)\u3068confidential(\u5916\u90e8\u9023\u643a)\u3067\u5206\u3051\u3001JWKS\u306fkid\u4e0d\u4e00\u81f4\u6642\u306e\u5f37\u5236\u518d\u53d6\u5f97\u3067\u30ed\u30fc\u30c6\u30fc\u30b7\u30e7\u30f3\u306b\u8ffd\u5f93\u3002\u300c\u8a8d\u8a3c\u306e\u5165\u53e3\u3092\u5909\u3048\u305f\u3044\u300d\u3060\u3051\u306a\u3089\u3001\u30c7\u30fc\u30bf\u30e2\u30c7\u30eb\u306e\u6839\u5e79\u306b\u624b\u3092\u5165\u308c\u308b\u5fc5\u8981\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u58ca\u3055\u306a\u3044\u5883\u754c\u3092\u3069\u3053\u306b\u5f15\u304f\u304b<\/strong>\u304c\u3001\u79fb\u884c\u306e\u6210\u5426\u3092\u5206\u3051\u307e\u3057\u305f\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
              \u3053\u306e\u8a18\u4e8b\u306b\u3064\u3044\u3066 \u500b\u4eba\u958b\u767a\u306e\u3042\u308b\u682a\u5f0f\u5206\u6790Web\u30a2\u30d7\u30ea\u3067\u3001\u8a8d\u8a3c\u57fa\u76e4\u3092\u300cDjango allauth + Simple JWT \u306e\u30e1\u30fc\u30eb\/\u30d1\u30b9\u30ef\u30fc\u30c9\u8a8d\u8a3c\u300d\u304b\u3089\u300cAWS Cognito User Pool \u30d9\u30fc\u30b9\u306e OAuth […]<\/p>\n","protected":false},"author":1,"featured_media":3374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"sns_share_botton_hide":"","vkExUnit_sns_title":"","_vk_print_noindex":"","sitemap_hide":"","_veu_custom_css":"","veu_display_promotion_alert":"common","vkexunit_cta_each_option":"","_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1175],"tags":[1176,814,1177,1017],"class_list":["post-3250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cognito","tag-cognito","tag-django","tag-oauth","tag-1017"],"veu_head_title_object":{"title":"","add_site_title":""},"jetpack_publicize_connections":[],"jetpack-related-posts":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/qol-kk.com\/wp2\/wp-content\/uploads\/2026\/09\/Cognito.jpg","_links":{"self":[{"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/posts\/3250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/comments?post=3250"}],"version-history":[{"count":2,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/posts\/3250\/revisions"}],"predecessor-version":[{"id":3294,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/posts\/3250\/revisions\/3294"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/media\/3374"}],"wp:attachment":[{"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/media?parent=3250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/categories?post=3250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qol-kk.com\/wp2\/wp-json\/wp\/v2\/tags?post=3250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}