phani-srikar
commented
1 year ago Hi @ritxweb, thanks for contacting us. Given your use-case which is to override the user groups in their claim via a pre-token generation lambda, have you tried using groupOverrideDetails in your lambda's response as mentioned in the docs here:
"groupOverrideDetails": {
"groupsToOverride": [
"custom-group-1",
"custom-group-2"
]
}You might need to modify your schema to static group based Auth as below:
type MyModel @model @auth(rules: [{allow: owner}, {allow: groups, groups: ["custom-group-1", "custom-group-2"]}]) {
id: ID!
myGroupsField: [String!]
}Please let us know if this works. Thanks.
alex-vladut
ritxweb
sundersc
naedx
unknown1337
How did you install the Amplify CLI?
npm
If applicable, what version of Node.js are you using?
v18.13.0
Amplify CLI Version
11.0.0
What operating system are you using?
Windows 10
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No
Describe the bug
I am creating a custom claim in Cognito in my JWT to add a list of groups that the user belongs to and defines their access to certain resources when querying AppSync. I am using the lambda pre token generation function to add this list (array) of groups (strings) to this custom claim but as already mentioned in this StackOverflow question:
https://stackoverflow.com/questions/49556221/how-to-add-array-values-in-claims-of-idtoken-in-cognito-using-claimstoaddoroverr
it is not possible to add objects like arrays of strings to custom Cognito claims like it works with the cognito:groups claim for instance. Only strings are allowed. The solution then is to JSON.stringify this array and add this to the claim. This works fine.
Now let's say we create a simple model in AppSync that looks like this:
When pushing this changes to Amplify it automatically generates VTL resolvers for sync and get objects of type MyModel. Here comes the problem. As I have seen, this behaviour of Cognito forcing to stringify the list of groups in my custom claim is correctly observed and treated in the generated VTL resolver function called QuerygetMyModelauth0Function that parses to JSON this claim and transforms it into a list that can be correctly treated by the resolver:
But in the resolver called QuerysyncMyModelsauth0Function (and some others) it uses this code:
Without calling to $util.parseJson with the claim that makes that the variable $group never gets a value so this claim is never checked against the myGroupsField, therefore denying access to the object.
Expected behavior
As Cognito doesn't currently allow to add arrays of strings to custom claims, all the VTL resolvers should parse this claims to correctly read permissions based on lists of groups and allow or deny access.
Reproduction steps
Project Identifier
No response
Log output
Additional information
No response
Before submitting, please confirm: