Closed vincent38wargnier closed 11 months ago
vincent38wargnier
commented
1 year ago The only solution I found for now is doing all my API calls like that :
try {
response = await API.graphql({
query: listRealisations,
authMode: 'AWS_IAM'
})
}
catch {
response = await API.graphql({
query: listRealisations,
authMode: 'AMAZON_COGNITO_USER_POOLS',
})
}
chrisbonifacio
commented
1 year ago Hey, could you try adding another line to your auth rules like so:
{allow: private, operations: [read], provider: iam}
and let me know if this authorizes the request with IAM while logged in.
vincent38wargnier
commented
1 year ago Hi @chrisbonifacio, sorry for the delay I was on holidays. I tried what you proposed, and I'm still facing the same issue.
Here is now how looks like my table with its authorisations :
type Realisation @model
@auth(rules: [
{allow: owner},
{allow: public, operations: [read] , provider: apiKey},
{allow: private, operations: [read]}
{allow: public, operations: [read], provider: iam}
{allow: private, operations: [read], provider: iam}
]){
id: ID!
name: String!
description: String
text: String
position: Int! @index(name: "byPosition", queryField: "getRealisationByPosition")
status: String! @index(name: "byStatus", queryField: "getRealisationByStatus")
images: [ImgFile]
} I also tried that :
type Realisation @model
@auth(rules: [
{allow: owner},
{allow: public, operations: [read] , provider: apiKey},
# {allow: private, operations: [read]}
{allow: public, operations: [read], provider: iam}
{allow: private, operations: [read], provider: iam}
]){
id: ID!
name: String!
description: String
text: String
position: Int! @index(name: "byPosition", queryField: "getRealisationByPosition")
status: String! @index(name: "byStatus", queryField: "getRealisationByStatus")
images: [ImgFile]
} And here is the result :
I also tried in SSR, because hopefully I will do those requests in SSR and not dynamically and I have the same error :
And Once I disconnect my user from Cognito, everything works fine. It seems that some cookies of Congito might block any other auth modes?
Thank you
vincent38wargnier
commented
1 year ago I think I found the source of my problem : the user is not a basic user but is part of a Cognito group. I added {allow: groups, groups: ["admin"]}, but the access stays denied. Is there any solution to do a graphql Querry with AWS_IAM when unauthenticated users are allowed while being connected to Cognito as a group member?
I wanted to add this line to the authorisation : {allow: groups, groups: ["admin"], provider: iam} But I got the following error :
Here is how looks my table now :
type Realisation @model
@auth(rules: [
{allow: owner},
{allow: public, operations: [read] , provider: apiKey},
{allow: groups, groups: ["admin"]}
# {allow: private, operations: [read]}
{allow: public, operations: [read], provider: iam}
{allow: private, operations: [read], provider: iam}
]){
id: ID!
name: String!
description: String
text: String
position: Int! @index(name: "byPosition", queryField: "getRealisationByPosition")
status: String! @index(name: "byStatus", queryField: "getRealisationByStatus")
images: [ImgFile]
}I also noticed that if instead of AWS_IAM i'm using API_KEY, the request works, whether I'm connected or not to Congito. So why is it not the same for AWS_IAM?
alharris-at
commented
11 months ago Hi @vincent38wargnier, it sounds like your user pool may not have unauthenticated users enabled (which is disabled by default), so if a user is not signed in, they will not have access to the public/iam auth method.
You can enable this feature by updating your user pool via amplify update auth and going through the walkthrough of full features, setting 'allow unauthenticated users' to true.
If that does not address your issue, feel free to reopen this request, and we'll continue working to assist you.
Before opening, please confirm:
JavaScript Framework
React
Amplify APIs
GraphQL API
Amplify Categories
auth
Environment information
Describe the bug
Hi, I'm facing an auth issue. I can't make graphQL queries with authMode: 'AWS_IAM' when i'm logged into cognito. Here is my GraphQl configuration :
I'm trying to list the Realisation elements with this code :
When the user is not logged in, it works ! PROBLEM : when the user is logged in with cognito, I have this error :
Expected behavior
When I specify the AuthMode to AWS_IAM, the result should be the same whatever is the Cognito session status
Reproduction steps
then create this table in graphql :
then amplify push, then create a cognito user, and log in then try to run this code :
Code Snippet
No response
Log output
aws-exports.js
/ eslint-disable / // WARNING: DO NOT EDIT. This file is automatically generated by AWS Amplify. It will be overwritten.
const awsmobile = { "aws_project_region": "eu-west-2", "aws_cognito_identity_pool_id": "**", "aws_cognito_region": "eu-west-2", "aws_user_pools_id": "", "aws_user_pools_web_client_id": "", "oauth": {}, "aws_cognito_username_attributes": [ "EMAIL" ], "aws_cognito_social_providers": [], "aws_cognito_signup_attributes": [ "EMAIL" ], "aws_cognito_mfa_configuration": "OFF", "aws_cognito_mfa_types": [ "SMS" ], "aws_cognito_password_protection_settings": { "passwordPolicyMinLength": 8, "passwordPolicyCharacters": [] }, "aws_cognito_verification_mechanisms": [ "EMAIL" ], "aws_appsync_graphqlEndpoint": "https://", "aws_appsync_region": "eu-west-2", "aws_appsync_authenticationType": "AMAZON_COGNITO_USER_POOLS", "aws_appsync_apiKey": "*", "aws_user_files_s3_bucket": "**", "aws_user_files_s3_bucket_region": "eu-west-2" };
export default awsmobile;
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response