How to debug Cognito's idpresponse endpoint

user_5578603 0
Viewed 3325

I'm setting up OIDC provider for Cognito User pool. The open id connect service I'm using is Paypal. At the step where paypal issues code and redirects to cognito's /oauth2/idpresponse endpoint after which cognito is supposed to exchange the code for access token, I'm receiving "Exception processing authorization code" error. As you can see the error message is not very discriptive.

I have no idea what I'm doing wrong. I did setup open id connect properly. Setup client settings in cognito and etc.

These are the endpoints I'm using for openid connect: https://www.sandbox.paypal.com/signin/authorize https://api.sandbox.paypal.com/v1/identity/openidconnect/tokenservice https://api.sandbox.paypal.com/v1/oauth2/token/userinfo https://api.sandbox.paypal.com/v1/oauth2/certs

In app client settings I have auth code grant flow and implicit flow enabled. I have custom domain setup. I provided paypal client id and secret

My guess is if I'm able to somehow debug idpresponse endpoint I should be able to solve the problem. Is there any way to do that? Maybe cloudwatch?

amazon-cognito amazon-web-services paypal openid
1 Answers

I don't know about debugging Cognito's endpoints, but I had the same problem and fixed it by doing the following:

  1. Go to your User Pool in AWS.
  2. In the side navigation under Federation, select Attribute mapping.
  3. Click the tab of the identity provider you're having issues with (in my case it was Google).

  4. There should be three columns, Capture, Google attribute, and User pool attribute. Make sure all of the attributes that are checked in the Capture column are mapped to an attribute in the User pool attribute column.

    UPDATE:

    After submitting this answer, I realized that the checkboxes in the Capture column are not checked by default. If you marked any attributes as required in the Attributes section of your user pool, then you need to map those attributes to the attributes provided by your external identity providers.

    For example, I marked email as a required attribute in my user pool settings. So, when I added Google as an identity provider, I had to go to Federation->Attribute mapping, click on the tab for Google, check the box in the Capture column next to email, and select Email from the dropdown box in the User pool attribute column.

After taking these steps, the sign in work-flow worked for me.

My guess is the auth flow works just fine between Cognito and your identity provider, but Cognito doesn't know how to map the attributes returned from the identity provider to the attributes you have set in your user pool (in General settings->Attributes under the Which standard attributes are required section).

user_57498750
Related