本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# 步驟 2：獲取帶有身分驗證碼的 URL
<a name="embedded-analytics-dashboards-with-anonymous-users-get-step-2"></a>

**重要**  
Amazon Quick Sight 有用於內嵌分析的新 APIs： `GenerateEmbedUrlForAnonymousUser`和 `GenerateEmbedUrlForRegisteredUser`。  
您仍然可以使用 `GetDashboardEmbedUrl`和 `GetSessionEmbedUrl` APIs 來內嵌儀表板和 Amazon Quick Sight 主控台，但它們不包含最新的內嵌功能。如需up-to-date內嵌體驗，請參閱將 [Amazon Quick Sight 分析內嵌至您的應用程式](https://docs.aws.amazon.com/quicksight/latest/user/embedding-overview.html)。


|  | 
| --- |
|  適用於：企業版  | 


|  | 
| --- |
|    目標對象：Amazon Quick 開發人員  | 

在下一章節，您可以了解如何在您的應用程式伺服器上代表匿名訪客進行身分驗證，以及取得可內嵌的儀表板 URL。

當使用者存取您的應用程式時，該應用程式代表使用者擔任 IAM 角色。然後，如果使用者尚未存在，它會將使用者新增至 Amazon Quick Sight。接著，它傳遞識別符當作唯一的角色工作階段 ID。

下列範例會代表使用者執行 IAM 身分驗證。它傳遞識別符當作唯一的角色工作階段 ID。此代碼在您的應用程式伺服器上運行。

------
#### [ Java ]

```
import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.quicksight.AmazonQuickSight;
import com.amazonaws.services.quicksight.AmazonQuickSightClientBuilder;
import com.amazonaws.services.quicksight.model.GetDashboardEmbedUrlRequest;
import com.amazonaws.services.quicksight.model.GetDashboardEmbedUrlResult;

/**
 * Class to call QuickSight AWS SDK to get url for dashboard embedding.
 */
public class GetQuicksightEmbedUrlNoAuth {

    private static String ANONYMOUS = "ANONYMOUS";

    private final AmazonQuickSight quickSightClient;

    public GetQuicksightEmbedUrlNoAuth() {
        this.quickSightClient = AmazonQuickSightClientBuilder
                .standard()
                .withRegion(Regions.US_EAST_1.getName())
                .withCredentials(new AWSCredentialsProvider() {
                                     @Override
                                     public AWSCredentials getCredentials() {
                                         // provide actual IAM access key and secret key here
                                         return new BasicAWSCredentials("access-key", "secret-key");
                                     }

                                     @Override
                                     public void refresh() {}
                                 }
                )
                .build();
    }

    public String getQuicksightEmbedUrl(
            final String accountId, // YOUR AWS ACCOUNT ID
            final String dashboardId, // YOUR DASHBOARD ID TO EMBED
            final String addtionalDashboardIds, // ADDITIONAL DASHBOARD-1 ADDITIONAL DASHBOARD-2
            final boolean resetDisabled, // OPTIONAL PARAMETER TO ENABLE DISABLE RESET BUTTON IN EMBEDDED DASHBAORD
            final boolean undoRedoDisabled // OPTIONAL PARAMETER TO ENABLE DISABLE UNDO REDO BUTTONS IN EMBEDDED DASHBAORD
    ) throws Exception {
        GetDashboardEmbedUrlRequest getDashboardEmbedUrlRequest = new GetDashboardEmbedUrlRequest()
                .withDashboardId(dashboardId)
                .withAdditionalDashboardIds(addtionalDashboardIds)
                .withAwsAccountId(accountId)
                .withNamespace("default") // Anonymous embedding requires specifying a valid namespace for which you want the embedding url
                .withIdentityType(ANONYMOUS)
                .withResetDisabled(resetDisabled)
                .withUndoRedoDisabled(undoRedoDisabled);

        GetDashboardEmbedUrlResult dashboardEmbedUrl = quickSightClient.getDashboardEmbedUrl(getDashboardEmbedUrlRequest);

        return dashboardEmbedUrl.getEmbedUrl();
    }
}
```

------
#### [ JavaScript ]

```
global.fetch = require('node-fetch');
const AWS = require('aws-sdk');

function getDashboardEmbedURL(
    accountId, // YOUR AWS ACCOUNT ID
    dashboardId, // YOUR DASHBOARD ID TO EMBED
    additionalDashboardIds, // ADDITIONAL DASHBOARD-1 ADDITIONAL DASHBOARD-2
    quicksightNamespace, // VALID NAMESPACE WHERE YOU WANT TO DO NOAUTH EMBEDDING
    resetDisabled, // OPTIONAL PARAMETER TO ENABLE DISABLE RESET BUTTON IN EMBEDDED DASHBAORD
    undoRedoDisabled, // OPTIONAL PARAMETER TO ENABLE DISABLE UNDO REDO BUTTONS IN EMBEDDED DASHBAORD
    getEmbedUrlCallback, // GETEMBEDURL SUCCESS CALLBACK METHOD
    errorCallback // GETEMBEDURL ERROR CALLBACK METHOD
    ) {
    const getDashboardParams = {
        AwsAccountId: accountId,
        DashboardId: dashboardId,
        AdditionalDashboardIds: additionalDashboardIds,
        Namespace: quicksightNamespace,
        IdentityType: 'ANONYMOUS',
        ResetDisabled: resetDisabled,
        SessionLifetimeInMinutes: 600,
        UndoRedoDisabled: undoRedoDisabled
    };

    const quicksightGetDashboard = new AWS.QuickSight({
        region: process.env.AWS_REGION,
    });

    quicksightGetDashboard.getDashboardEmbedUrl(getDashboardParams, function(err, data) {
        if (err) {
            console.log(err, err.stack);
            errorCallback(err);
        } else {
            const result = {
                "statusCode": 200,
                "headers": {
                    "Access-Control-Allow-Origin": "*", // USE YOUR WEBSITE DOMAIN TO SECURE ACCESS TO GETEMBEDURL API
                    "Access-Control-Allow-Headers": "Content-Type"
                },
                "body": JSON.stringify(data),
                "isBase64Encoded": false
            }
            getEmbedUrlCallback(result);
        }
    });
}
```

------
#### [ Python3 ]

```
import json
import boto3
from botocore.exceptions import ClientError
import time

# Create QuickSight and STS clients
qs = boto3.client('quicksight',region_name='us-east-1')
sts = boto3.client('sts')

# Function to generate embedded URL
# accountId: YOUR AWS ACCOUNT ID
# dashboardId: YOUR DASHBOARD ID TO EMBED
# additionalDashboardIds: ADDITIONAL DASHBOARD-1 ADDITIONAL DASHBOARD-2 WITHOUT COMMAS
# quicksightNamespace: VALID NAMESPACE WHERE YOU WANT TO DO NOAUTH EMBEDDING
# resetDisabled: PARAMETER TO ENABLE DISABLE RESET BUTTON IN EMBEDDED DASHBAORD
# undoRedoDisabled: OPTIONAL PARAMETER TO ENABLE DISABLE UNDO REDO BUTTONS IN EMBEDDED DASHBAORD
def getDashboardURL(accountId, dashboardId, quicksightNamespace, resetDisabled, undoRedoDisabled):
    try:
        response = qs.get_dashboard_embed_url(
            AwsAccountId = accountId,
            DashboardId = dashboardId,
            AdditionalDashboardIds = additionalDashboardIds,
            Namespace = quicksightNamespace,
            IdentityType = 'ANONYMOUS',
            SessionLifetimeInMinutes = 600,
            UndoRedoDisabled = undoRedoDisabled,
            ResetDisabled = resetDisabled
        )
            
        return {
            'statusCode': 200,
            'headers': {"Access-Control-Allow-Origin": "*", "Access-Control-Allow-Headers": "Content-Type"},
            'body': json.dumps(response),
            'isBase64Encoded':  bool('false')
        }
    except ClientError as e:
        print(e)
        return "Error generating embeddedURL: " + str(e)
```

------
#### [ Node.js ]

以下範例顯示的 JavaScript (Node.js) 可在應用程式伺服器上用來取得嵌入儀表板的 URL。您可以在您的網站或應用程式中使用此 URL 來顯示儀表板。

**Example**  

```
const AWS = require('aws-sdk');
            const https = require('https');
            
            var quicksight = new AWS.Service({
                apiConfig: require('./quicksight-2018-04-01.min.json'),
                region: 'us-east-1',
            });
            
            quicksight.getDashboardEmbedUrl({
                'AwsAccountId': '111122223333',
                'DashboardId': '{{dashboard-id}}',
                'AdditionalDashboardIds': '{{added-dashboard-id-1 added-dashboard-id-2 added-dashboard-id-3}}'
                'Namespace' : '{{default}}',
                'IdentityType': 'ANONYMOUS',
                'SessionLifetimeInMinutes': 100,
                'UndoRedoDisabled': false,
                'ResetDisabled': true
            
            }, function(err, data) {
                console.log('Errors: ');
                console.log(err);
                console.log('Response: ');
                console.log(data);
            });
```

**Example**  

```
//The URL returned is over 900 characters. For this example, we've shortened the string for
            //readability and added ellipsis to indicate that it's incomplete.
                                { Status: 200,
              EmbedUrl: 'https://dashboards.example.com/embed/620bef10822743fab329fb3751187d2d…
              RequestId: '7bee030e-f191-45c4-97fe-d9faf0e03713' }
```

------
#### [ .NET/C\# ]

以下範例顯示的 .NET/C\# 程式碼可在應用程式伺服器上用來取得嵌入儀表板的 URL。您可以在您的網站或應用程式中使用此 URL 來顯示儀表板。

**Example**  

```
            var client = new AmazonQuickSightClient(
                AccessKey,
                SecretAccessKey,
                sessionToken,
                Amazon.RegionEndpoint.USEast1);
            try
            {
                Console.WriteLine(
                    client.GetDashboardEmbedUrlAsync(new GetDashboardEmbedUrlRequest
                    {
                        AwsAccountId = “{{111122223333}}”,
                        DashboardId = {{"dashboard-id"}},
                        AdditionalDashboardIds = {{"added-dashboard-id-1 added-dashboard-id-2 added-dashboard-id-3"}},
                        Namespace = {{default}},
                        IdentityType = IdentityType.ANONYMOUS,
                        SessionLifetimeInMinutes = 600,
                        UndoRedoDisabled = false,
                        ResetDisabled = true
                    }).Result.EmbedUrl
                );
            } catch (Exception ex) {
                Console.WriteLine(ex.Message);
            }
```

------
#### [ AWS CLI ]

若要擔任角色，請選擇下列其中一個 AWS Security Token Service (AWS STS) API 操作：
+ [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) – 在使用 IAM 身分擔任角色的情況下使用此操作。
+ [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) – 在使用 Web 身分提供者驗證您的使用者時，請使用此操作。
+ [AssumeRoleWithSaml](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html) –在您使用安全性聲明標記語言 (SAML) 驗證使用者時，請使用此操作。

以下範例顯示用來設定 IAM 角色的 CLI 命令。角色需要啟用 `quicksight:GetDashboardEmbedURL` 的許可。

```
aws sts assume-role \
     --role-arn "{{arn:aws:iam::{{11112222333}}:role/{{QuickSightEmbeddingAnonymousPolicy}}}}" \
     --role-session-name {{anonymous caller}}
```

`assume-role` 操作會傳回三個輸出參數：存取金鑰、私密金鑰和工作階段字符。

**注意**  
若您呼叫 `AssumeRole` 操作時收到 `ExpiredToken` 錯誤，原因可能是先前的 `SESSION TOKEN` 仍在環境變數中。設定以下變數便可清除此錯誤：  
*AWS\_ACCESS\_KEY\_ID* 
*AWS\_SECRET\_ACCESS\_KEY* 
*AWS\_SESSION\_TOKEN* 

以下範例說明如何在 CLI 中設定這三個參數。如果您使用 Microsoft Windows 電腦，請使用 `set`，不要使用 `export`。

```
export AWS_ACCESS_KEY_ID     = "{{access_key_from_assume_role}}"
export AWS_SECRET_ACCESS_KEY = "{{secret_key_from_assume_role}}"
export AWS_SESSION_TOKEN     = "{{session_token_from_assume_role}}"
```

對於瀏覽您網站的使用者，執行這些命令可將其角色工作階段 ID 設為 `embedding_quicksight_dashboard_role/QuickSightEmbeddingAnonymousPolicy`。角色工作階段 ID 由來自 `role-arn` 和 `role-session-name` 值的角色名稱所組成。對每個使用者使用唯一的角色工作階段 ID，可確保為每個訪問使用者設定適當的許可。它還使每個會話獨立且不同。如果您正在使用 Web 伺服器陣列 (例如負載平衡)，且工作階段重新連線到不同的伺服器，則會開始新的工作階段。

為了取得儀表板的簽章 URL，請從應用程式伺服器呼叫 `get-dashboard-embed-url`。這會傳回可嵌入的儀表板 URL。下列範例顯示如何使用伺服器端呼叫，針對匿名造訪您的 Web 入口網站或應用程式的使用者，獲取內嵌式儀表板的 URL。

```
aws quicksight get-dashboard-embed-url \
     --aws-account-id {{111122223333}} \
     --dashboard-id {{dashboard-id}} \
     --additional-dashboard-ids {{added-dashboard-id-1 added-dashboard-id-2 added-dashboard-id-3}}
     --namespace {{default-or-something-else}} \
     --identity-type {{ANONYMOUS}} \
     --session-lifetime-in-minutes {{30}} \
     --undo-redo-disabled {{true}} \
     --reset-disabled {{true}} \
     --user-arn arn:aws:quicksight:{{us-east-1}}:{{111122223333}}:user/default/{{QuickSightEmbeddingAnonymousPolicy}}/embeddingsession
```

如需有關使用此操作的詳細資訊，請參閱 [https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetDashboardEmbedUrl.html](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetDashboardEmbedUrl.html)。您可以在您自己的程式碼中使用這個和其他 API 操作。

------