Login cognito using with scope openId using id_token or access_token don't working

user_9620996 0
Viewed 1912

I'm using cognito to authenticate to node-js using amazon-cognito-identity-js I logged in and it returns me an access_token, id_token and refresh_token but none of them work when I'm using the open id scope with authorization code grant.

enter image description here enter image description here enter image description here enter image description here

I don't know if I need to call another service or do another process to get access at the gateway

but when I generate a token using client_credentials flow the api gateway works

aws-lambda amazon-cognito node.js
1 Answers

If I understood correctly, the scopes you are setting are OAuth 2.0 scopes and require using the OAuth 2.0 endpoints (e.g. the hosted UI, or an external IdP federation). Your code seems to be using the non OAuth 2.0 flow (e.g. I assume InitiateAuth with SRP). If you decode the JWT I believe you will see it has only the aws.cognito.signin.user.admin scope.

For using custom scopes you will need to

  1. send the access token (not the id token)
  2. use token you got from the token endpoint (e.g. using the hosted UI or federation) - they will contain the scopes you set in the screenshot

For using the open_id scope, same as above but send the id token, not the access token, and remove the custom OAuth scopes in API Gateway (if you put them it will expect an access token)

p.s. custom scopes work great with the client credentials flow, but less with the authorization code flow if it doesn't have a client secret.

Lastly I recommend you take a look at AWS Amplify as it will handle a lot of that for you behind the scenes as well as include security features such as PKCE out of the box.

Relevant github issue: https://github.com/aws-amplify/amplify-js/issues/3732

user_2391680
Related