Datastore authProvider is not working with Custom Lambda authorization mode

Sanoodia commented 11 months ago

Before opening, please confirm:

[X] I have searched for duplicate or closed issues and discussions.
[X] I have read the guide for submitting bug reports.
[X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React

Amplify APIs

DataStore

Amplify Categories

auth, api

Environment information

System: OS: Linux 6.2 Ubuntu 22.04.3 LTS 22.04.3 LTS (Jammy Jellyfish) CPU: (4) x64 Intel(R) Core(TM) i5-7300U CPU @ 2.60GHz Memory: 3.43 GB / 15.50 GB Container: Yes Shell: 5.1.16 - /bin/bash Binaries: Node: 16.20.2 - ~/.nvm/versions/node/v16.20.2/bin/node Yarn: 1.22.21 - ~/.nvm/versions/node/v16.20.2/bin/yarn npm: 8.19.4 - ~/.nvm/versions/node/v16.20.2/bin/npm Browsers: Chrome: 119.0.6045.159 npmPackages: @ant-design/charts: ^2.0.1 => 2.0.1 @ant-design/icons: ^5.2.6 => 5.2.6 @aws-amplify/ui-react: ^6.0.3 => 6.0.3 @aws-amplify/ui-react-internal: undefined () @chatscope/chat-ui-kit-react: ^1.10.1 => 1.10.1 @chatscope/chat-ui-kit-styles: ^1.4.0 => 1.4.0 @fortawesome/fontawesome-svg-core: ^6.4.2 => 6.4.2 (1.2.36) @fortawesome/free-regular-svg-icons: ^6.4.2 => 6.4.2 @fortawesome/free-solid-svg-icons: ^6.4.2 => 6.4.2 (5.15.4) @fortawesome/react-fontawesome: ^0.2.0 => 0.2.0 (0.1.19) @jitsu/jitsu-react: ^1.7.2 => 1.7.2 @testing-library/jest-dom: ^5.17.0 => 5.17.0 @testing-library/react: ^13.4.0 => 13.4.0 @testing-library/user-event: github:testing-library/user-event => 0.0.0-semantically-released antd: ^5.11.3 => 5.11.3 aws-amplify: ^6.0.5 => 6.0.5 aws-amplify/adapter-core: undefined () aws-amplify/analytics: undefined () aws-amplify/analytics/kinesis: undefined () aws-amplify/analytics/kinesis-firehose: undefined () aws-amplify/analytics/personalize: undefined () aws-amplify/analytics/pinpoint: undefined () aws-amplify/api: undefined () aws-amplify/api/server: undefined () aws-amplify/auth: undefined () aws-amplify/auth/cognito: undefined () aws-amplify/auth/cognito/server: undefined () aws-amplify/auth/server: undefined () aws-amplify/datastore: undefined () aws-amplify/in-app-messaging: undefined () aws-amplify/in-app-messaging/pinpoint: undefined () aws-amplify/push-notifications: undefined () aws-amplify/push-notifications/pinpoint: undefined () aws-amplify/storage: undefined () aws-amplify/storage/s3: undefined () aws-amplify/storage/s3/server: undefined () aws-amplify/storage/server: undefined () aws-amplify/utils: undefined () axios: ^1.6.2 => 1.6.2 dayjs: ^1.11.10 => 1.11.10 dotenv: ^16.3.1 => 16.3.1 (10.0.0) draft-js: ^0.11.7 => 0.11.7 graphql: ^16.8.1 => 16.8.1 (15.8.0) graphql-tag: ^2.12.6 => 2.12.6 history: ^5.3.0 => 5.3.0 html-to-image: ^1.11.11 => 1.11.11 immutability-helper: ^3.1.1 => 3.1.1 immutable: ^5.0.0-beta.4 => 5.0.0-beta.4 (3.7.6) is-offline: ^2.1.1 => 2.1.1 moment-timezone: ^0.5.43 => 0.5.43 react: ^18.2.0 => 18.2.0 react-dnd: ^16.0.1 => 16.0.1 react-dnd-html5-backend: ^16.0.1 => 16.0.1 react-dom: ^18.2.0 => 18.2.0 react-gtm-module: ^2.0.11 => 2.0.11 react-idle-timer: ^5.7.2 => 5.7.2 react-if: ^4.1.5 => 4.1.5 react-infinite-scroll-component: ^6.1.0 => 6.1.0 react-lodash: ^0.1.2 => 0.1.2 react-places-autocomplete: ^7.3.0 => 7.3.0 react-quill: ^2.0.0 => 2.0.0 react-redux: ^8.1.3 => 8.1.3 react-router-dom: ^6.20.0 => 6.20.0 react-scripts: 5.0.1 => 5.0.1 react-select: ^5.8.0 => 5.8.0 react-toasts: ^3.0.6 => 3.0.6 react-virtualized: ^9.22.5 => 9.22.5 redux-persist: ^6.0.0 => 6.0.0 redux-persist/integration/react: undefined () underscore: ^1.13.6 => 1.13.6 (1.12.1) use-timer: ^2.0.1 => 2.0.1 uuid: ^9.0.1 => 9.0.1 (8.3.2) web-vitals: ^2.1.4 => 2.1.4 xlsx: ^0.18.5 => 0.18.5 npmGlobalPackages: corepack: 0.17.0 npm: 8.19.4 yarn: 1.22.21

Describe the bug

My last code was in v5 during migration from v5 to v6 i follow the documentation for migration but after follwing each step i found that DataStore authProvider is not woring with custom LAMBDA authorization mode

Expected behavior

My last code was working fine with this code and token is also valid cuz i also have check appSync query call its working fine with validation of same token ... Datastore configuration should also validate token if AppSync query is working fine with same token

Reproduction steps

Migrate all aws-amplify v5 to v6
flowed all steps for migration like amplify upgrade, amplify codegen modal and amplify push
then repalce new amplifyconfiguration.json with old aws-exports.js

Code Snippet

DataStore.configure({
       syncPageSize: 1000,
       maxRecordsToSync: 200000,
       authProviders: {
         functionAuthProvider: async () => {
           console.log("refreshAuthToken",userData.token) // console not logging thing line
           const authToken = await refreshAuthToken(); // refreshAuthToken
           return {
             token: userData.token
           };
         }
       },
       syncExpressions: [
         syncExpression(GlobalLookups, () => {
           try{
             return Predicates.ALL;
           }catch(error){
             console.log(error, userData);
           }
         })
       ],
       errorHandler: (error) => {
         console.log(error)
       },
     });

Log output

 53:31.202 DataStore - Sync processor retry error: Error: No credentials
    at InternalGraphQLAPIClass._headerBasedAuth (InternalGraphQLAPI.ts:50:1)
    at async InternalGraphQLAPIClass._graphql (InternalGraphQLAPI.ts:161:1)
    at async sync.ts:119:1
    at async retry.ts:33:1

also getting warnings like this

DataStore - User is unauthorized to query syncGlobalLookups with auth mode iam. No data could be returned.

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

imranmunir312 commented 11 months ago

I am trying to configure Datastore with custom Authentication using AWS_LAMBDA but it's constantly showing unauthorized but on the other hand same auth flow is working fine with App Sync. Need Help!

DataStore.configure({ authProviders: { functionAuthProvider: async () => { const authToken = await refreshAuthToken(); return { token: authToken }; } } });

chrisbonifacio commented 11 months ago

Hi @imranmunir312 :wave: thanks for raising this issue.

From the error log, it says that the user is unauthorized to query via IAM, but you should be using AWS_LAMBDA as the auth mode.

You either have to enable Multi Auth in the DataStore configuration following the example in our docs:


import { DataStore, AuthModeStrategyType } from 'aws-amplify/datastore';

DataStore.configure({
  authModeStrategyType: AuthModeStrategyType.MULTI_AUTH
});

OR

change the default authentication type of your API by running amplify update api > GraphQL > Authorization modes > select LAMBDA > amplify push

With Multi Auth disabled, DataStore will only attempt to authorize requests using the default authentication type. With Multi Auth enabled, DataStore will re-attempt a failed request with other auth modes.

Sanoodia commented 11 months ago

@chrisbonifacio thanks for sharing solution . It worked!!!

imranmunir312 commented 11 months ago

@chrisbonifacio Thanks for the solution you can close the issue.

aws-amplify / amplify-js