401 Unauthorized on API Gateway

[matiboy]

Hi, I'm having problems with using a Cognito Pool Authorizer on API Gateway.

What works:

• able to login using Cognito
• able to create CognitoIdentityCredentials for an Identity pool and refresh them so I can see a sessionToken, accessKeyId, and secretAccessKey ; not sure how to check whether they represent what I need though, if there is a way?
• I then create an apiClient using apigClientFactory.newClient passing the details from credentials, and the region. I can see the options are saved in the config. The auth_type is automatically set to 'AWS_IAM', that should be correct, right?

What doesn't work: Now when making a call to an API that is protected by the Cognito authorizer, I get a 401 UnauthorizedException

I've checked the Authorization header, looks something like {code}AWS4-HMAC-SHA256 Credential=ASIAJ2FWUMSYLSBPQL6Q/20171118/us-east-2/execute-api/aws4_request, SignedHeaders=accept;host;x-amz-date, Signature=6bcf047733069.....{code} and put it into the Authorizer Test form (I should put the entire header, not just the signature, right?) and that fails too with 401.

Wondering what I can try in order to find out where the issue , how to "debug" the 401 (is it policy, wrong IdentityPool, etc?)

Thanks!

Mat

Summary of questions:

1. Is there a way to check that the CognitoIdentityCredentials I have correspond to the correct IdentityPool?
2. Is is correct that auth type should be "AWS_IAM" when using the Cognito credentials
3. In the test form for Authorizer, do I put the entire Authorization header or just the signature
4. What can I do to try and find out the root of the issue, since there are so many moving parts

[sandangel]

use result.getIdToken().getJwtToken(); not result.getAccessToken().getJwtToken() I have the same issue and finally find out it just a silly mistake

[chantii]

facing same issue, what is the solution here?

[itrestian]

See issue below that might help you debug:

https://forums.aws.amazon.com/thread.jspa?threadID=240420

[matiboy]

Simply setting the value of result.getIdToken().getJwtToken() as Authorizer header is working, though that doesn't go through Federated Identity at all.

[itrestian]

It shouldn't, the API Gateway Cognito Authorizer is directly integrated with User Pools.