Open david-sunsyte opened 1 month ago
Hello, @david-sunsyte 👋. Trying to understand how to reproduce this figure out the root cause of what's blocking you here. Can you clarify where the tokens are coming from in your implementation of your customer token provider? Are you using TokenProvider
somewhere else in the code that's not referenced in this issue (example from docs)?
Also, is Google the IDP for your User Pool? I'm not understanding the need for the Custom Token Provider aspect if you're looking to just use Google as a federated IDP. Any additional context/clarity on the above items would be appreciated. Thanks!
Hi @cwomack , thank you so much for your reply. The tokens are coming from the callback from the google initialize function shown below:
window.google.accounts.id.initialize({
client_id: process.env.GOOGLE_CLIENT_ID,
callback: (response: any) => {
customCredentialsProvider.loadFederatedLogin({
domain: 'accounts.google.com',
token: response.credential,
});
const fetchSessionResult = await fetchAuthSession(); // will return the credentials
console.log('fetchSessionResult: ', fetchSessionResult);
},
});
Granted, I did this as a long shot and in the absence of being able to identify my issue. The overall problem I'm trying to solve is for is to authenticate via Google and retrieve a token that can then be exchanged for Cognito tokens (preferrably id_token) so I can access my backend API.
I may not need to use the custom token provider to achieve this, I just don't know which way to go with this.
Hello @david-sunsyte.
You might want to use a custom token provider to make authenticated calls to AppSync
— assuming AppSync was configured to accept OIDC tokens before.
And you might want to use a custom credentials provider to generate AWS Credentials without using Cognito User Pools
, hence avoiding creating Cognito tokens and being unable to call the cognito-idp
endpoints.
If you want to create Cognito tokens, use Google as your social provider, and also create AWS Credentials. You need to configure your User Pool
with Google, configure Amplify, and then call the signInWithRedirect
API to authenticate to Google. Once you have this setup, you don't need to setup a custom token and credentials provider.
-docs to configure and use social providers with Amplify: https://docs.amplify.aws/react/build-a-backend/auth/concepts/external-identity-providers/
Before opening, please confirm:
JavaScript Framework
React
Amplify APIs
Authentication
Amplify Version
v6
Amplify Categories
auth
Backend
Other
Environment information
Describe the bug
I've currently implemented a customCredentialsProvider (as shown here - https://docs.amplify.aws/react/build-a-backend/auth/advanced-workflows/) to federate an a Google identity. I successfully receive the credential from Google. I then created a customTokenProvider (as shown here - https://docs.amplify.aws/react/build-a-backend/auth/advanced-workflows/#custom-token-providers)
My issue is that I don't receive the Cognito tokens JwtBearer auth and using the Cognito user pool as the issuer.
https://cognito-idp.us-east-1.amazonaws.com/{userPoolId}
Expected behavior
After receiving the response.credential from Google, I would expect to be able to exchange the id_token that's returned for valid Cognito tokens so I can access my backend API.
Reproduction steps
Launch google sign in as shown here : https://docs.amplify.aws/react/build-a-backend/auth/advanced-workflows/#google-sign-in-react
Successfully auth with Google
Code Snippet
Log output
aws-exports.js
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response