Android and AWS Cognito Developer Authenticated Identities

Question

I'm building an Android app that will utilize Cognito for user authentication. I'm using Developer Authenticated Identities and retrieving an Identity ID and token from my backend service successfully however I'm not able to figure how to us the Identity ID and token for S3. I have done this successfully in JavaScript like so...

AWS.config.region = 'us-east-1';
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
  IdentityPoolId: 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
  IdentityId: identityid,
  Logins: {
    'cognito-identity.amazonaws.com': token
  }
});

I've tried with...

Map logins = new HashMap();;
logins.put("cognito-identity.amazonaws.com", token);
credentials = new CognitoCachingCredentialsProvider (
   context,
   "us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
   Regions.US_EAST_1
);
credentials.setLogins(logins);

s3 = new AmazonS3Client(credentials);
List bucket = s3.listBuckets();

but this throws an exception...

Invalid login token. Can't pass in a Cognito token. I've also tried implement my own identity provider class as detailed here...

https://docs.aws.amazon.com/cognito/latest/developerguide/developer-authenticated-identities.html

but this is also unsuccessful. Can someone point my in the right direction?

Thanks in advance.

Have you compared your Identity Provider with the one in Cognito's sample app? If so, and you are still having trouble, sample code would be helpful in debugging your issue. github.com/awslabs/aws-sdk-android-samples/blob/master/… — Mark Mercurio

e-nouri e-nouri · Accepted Answer · 2016-03-15T13:39:56

I did this with Node.js, but I assume Android SDK have a similar API. You get and IdentityId after creating an identity (either with Oauth provider, or without), then you request IAM temporary credentials for that identityId. You will have an accessKey, secretKey and a token, use them to configure the AWS.config.

After that you can use any service from AWS SDK, but you need to make suer that your pool of identities have the right roles/policies attached to it.

NB: give the least and the only needed access, or you will expose your services for malicious use!

The token have expiration date, which you can set, I didn't checked if AWS Cognito refresh it automatically or not.

Android and AWS Cognito Developer Authenticated Identities

1 Answers