Authenticate with Cognito Federated Identities

Question

I am having a hard time trying to figure out how to use Amazon Cognito in my web app (Java based). I want to have some kind of authentication hub (Amazon Cognito) to authenticate user with multiple Auth Providers - that's why I want to use Amazon Cognito! :)

Firstly, I set up User Pool (I have my UserPoolId: eu-central-1_xxxxxxxxxx) and created there one user. Next I created Identity Pool with IdentityPoolId (eu-central-1:yyyyyyyyyy). Then I authenticate with AWS JavaScript SDK to UserPool to get idToken and it working quite fine! I receive idToken from Cognito UserPool. Then I am sending this idToken to my backend app (Java based) and there I want to validate this idToken with IdentityPool. I added new Authentication Provider - Cognito with UserPoolId and newly created id of an App that I added in UserPool. I tried to follow with this tutorial: https://aws.amazon.com/blogs/mobile/use-amazon-cognito-in-your-website-for-simple-aws-authentication/ But everytime I make

GetID

request I recevied Exception with

com.amazonaws.services.cognitoidentity.model.NotAuthorizedException: Token is not from a supported provider of this identity pool.

My Java code is below:

final AmazonCognitoIdentityClient identityClient = new AmazonCognitoIdentityClient(
                new BasicAWSCredentials("accessKey", "secretKey"));
identityClient.setRegion(Region.getRegion(Regions.EU_CENTRAL_1));

GetIdRequest idRequest = new GetIdRequest();
idRequest.setAccountId("accountId");
idRequest.setIdentityPoolId(identityPoolId);

final String providerName = "cognito-idp.eu-central-1.amazonaws.com/eu-central-1_xxxxxxxx";

Map providerTokens = new HashMap();
providerTokens.put(providerName, idToken);
idRequest.setLogins(providerTokens);

GetIdResult idResp = identityClient.getId(idRequest);

Does anyone could help me with this task? Maybe I am doing something wrong?

Thanks, Kamil :)

Mike Patrick Mike Patrick · Accepted Answer · 2017-10-14T15:41:21

There are three pieces of data that need to match in this scenario:

Provider as configured in AWS.
Provider as put into the Logins map.
iss value (issuer) in the id token.

When I have seen this error, it has been because the value in the Logins map does not match the provider as configured in AWS.

For example, an unexpected port number or trailing slash can cause these not to match.

Beyond this, there are a couple of settings in AWS that need to line up.

Provider as configured in AWS

With a Cognito User Pool, Amazon configures this name for you, so it's non-configurable on the backend. The format of the providerName in your Java code looks good, but first I'd triple check the xxxxxxx part for a typo.

App Client settings

Then, make sure your App Client has Cognito enabled in your User Pool settings:

Federated Identities settings

Next, in your federated identities settings, verify that the user pool id and client id appear in the Cognito tab under "Authentication providers", and that they match your user pool and App Client.

JWT issuer

Finally, I would expect the error to be "Invalid login token. Issuer doesn't match providerName" if there was a problem with the iss value in the JWT. However, decoding the id token you get back and inspecting the contents (as suggested in another answer) is also good advice.

If all these pieces appear to be in place, and the error persists, please leave a comment. Happy Hacking!

Authenticate with Cognito Federated Identities

2 Answers