Open slimandslam opened 3 years ago
chrisbonifacio
commented
3 years ago I think if you just need to get those credentials over to the api in your request, you may be able to set them in the third argument to API.get as documented here:
https://docs.amplify.aws/lib/restapi/fetch/q/platform/js
You can set them in the headers or as query parameters, etc, for use in determining your API response.
Let me know if this helps!
slimandslam
commented
3 years ago Those credentials are temporary credentials for a Cognito Unauthenticated user. They are needed for authentication with API Gateway (but a Lambda function will also consume them). In any case, the link you provided does not have an example of how to include these temporary credentials. Typically, they have to be handled in a specific way with specific case sensitivity (e.g. "sessionToken: SessionToken", not "SessionToken: Sessiontoken")
One of the great things about Amplify is that you can use API Gateway, as an authenticated Cognito user, with minimal config, and do calls like this: API.get("mybackend", "/api/v1/somecall");
However, I don't see the syntax for how to do this call if I'm a temporary user (using a Role that allows the API Gateway call). I can generate the temp credentials, but how do I use them?
chrisbonifacio
commented
3 years ago Sorry, there are still gaps in my knowledge of the Auth category. May I ask how you are generating the credentials and how you intend to use them in your API?
I'm not sure that you need to generate credentials to make the api call. It sounds like Amplify might handle that for you. Are you receiving an error when calling API.get?
https://docs.amplify.aws/lib/restapi/authz/q/platform/js/#unauthenticated-requests
slimandslam
commented
3 years ago This is not an unauthenticated request. It's a Cognito Unauthenticated user making a request. The Cognito Unauthenticated user has a role (stored in Cognito) which lets the Cognito Unauthenticated user do only things specified in that role.
To create the temporary credentials, I had to use three API calls: GetIdCommand() GetOpenIdTokenCommand() AssumeRoleWithWebIdentityCommand()
The last call required the Cognito UNauthenticated role ARN.
stale[bot]
commented
3 years ago This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
stale[bot]
commented
3 years ago This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.
chrisbonifacio
commented
3 years ago Hi :wave: Sorry this was auto-closed by stale bot. We are working towards preventing this from happening in the future. Please let us know if you are still experiencing this issue and in need of assistance.
slimandslam
commented
3 years ago Thanks!
On Fri, Jul 23, 2021 at 1:15 PM Chris Bonifacio @.***> wrote:
Hi 👋 Sorry this was auto-closed by stale bot. We are working towards preventing this from happening in the future. Please let us know if you are still experiencing this issue and in need of assistance.
— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/aws-amplify/amplify-js/issues/8381#issuecomment-885890779, or unsubscribe https://github.com/notifications/unsubscribe-auth/AABYBR4UFHWC4YW7PYIKJSDTZHEVXANCNFSM457RKLGQ .
hkjpotato
commented
2 years ago @slimandslam if I understand it correctly, you want to inject a credentials you get from a separate cognito identity pool? If you are using amplify to setup the identity pool, then the unauth credentials should be managed internally by the amplify, so you should not need to call the direct cognito commands.
ventocis
commented
2 years ago @slimandslam I am having the same issue. It sounds like you may have figured out how to attach the credentials using the methods below? Where are you getting these methods? I didn't see them in the Auth documentation. Thanks!
To create the temporary credentials, I had to use three API calls: GetIdCommand() GetOpenIdTokenCommand() AssumeRoleWithWebIdentityCommand()
The last call required the Cognito UNauthenticated role ARN.
slimandslam
commented
2 years ago I believe that one of the maintainers of the AWS SDK for JavaScript V3 API created an example somewhere (after I asked him about it) but I don't recall where.
The code below is what I use in React, but I assume it's pretty generic AWS SDK for JS V3 code.......
Note that there are examples of how to do this using AWS SDK for JS V2. (VERSION TWO), but not V3. I see no way to do this using AWS Amplify for JS because there is no way to use temporary credentials when making API calls. I'm specifically wanting to use temp credentials so that unauthorized visitors can do some bookkeeping API calls using the UNAUTH_ROLE_ARN. I wouldn't waste my time speculating on how to do this unless you have a verified working example. :-)
Required imports:
import { CognitoIdentityClient, GetIdCommand, GetOpenIdTokenCommand} from "@aws-sdk/client-cognito-identity";
import { STSClient, AssumeRoleWithWebIdentityCommand} from "@aws-sdk/client-sts";
import { fromCognitoIdentityPool } from "@aws-sdk/credential-provider-cognito-identity";
The basic flow:
const stsclnt = new STSClient({ region: "us-west-2" });
const cognitoIdentityClient = new CognitoIdentityClient({
region: "us-west-2",
});
const cogident = new CognitoIdentityClient({
region: "us-west-2",
credentials: fromCognitoIdentityPool({
client: cognitoIdentityClient,
identityPoolId: config.cognito.IDENTITY_POOL_ID,
}),
});
var GetParams = {
IdentityPoolId: config.cognito.IDENTITY_POOL_ID,
};
try {
const data = await cogident.send(new GetIdCommand(GetParams));
const OpenParams = { IdentityId: data.IdentityId };
const moredata = await cogident.send(new GetOpenIdTokenCommand(OpenParams));
const credParams = {
RoleArn: config.UNAUTH_ROLE_ARN,
RoleSessionName: "websesh",
WebIdentityToken: moredata.Token,
};
const moredata2 = await stsclnt.send(
new AssumeRoleWithWebIdentityCommand(credParams)
);
return moredata2; // AccessKeyId, SecretAccessKey, SessionToken
} catch..........
Before opening, please confirm:
JavaScript Framework
React, Not applicable
Amplify APIs
REST API
Amplify Categories
api
Environment information
Describe the bug
There appears to be no way to make an API call using a generated set of credentials. I generated temporary credentials:
I want to use them in an Amplify-JS call like this:
API.get("mybackend", "/api/v1/somecall");However, there doesn't seem to be a way to do that.
Expected behavior
I'm expecting a clear way to use temporary credentials in an Amplify-JS API call.
Reproduction steps
Code Snippet
Log output
aws-exports.js
No response
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response