amplify federatedSignIn returns accessToken without scopes

Question

I'm trying to use amplify for my Vue app but I have some issues.

When I authenticate manually via Auth.signIn, all goes fine, I get the access token, I pass it to my backend and get the data I want.

But I wanted to save time by not having to build the flows of reset, confirm, forget password, then I tried to use Auth.federatedSignIn

When I do this, the auth works fine as well, but when I pass the accessToken I got to the backend, ie complains the following:

Access Token does not have required scopes

Error executing "GetUser" on "https://cognito-idp.eu-central-1.amazonaws.com"; AWS HTTP error: Client error: `POST https://cognito-idp.eu-central-1.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"NotAuthorizedException","message":"Access Token does not have required scopes"}
 NotAuthorizedException (client): Access Token does not have required scopes - {"__type":"NotAuthorizedException","message":"Access Token does not have required scopes"}

How do I call Auth.federatedSignIn() and make my token have these scopes exactly as the Auth.signIn()? Is there an additional argument I have to add?

I don't think it's my PHP/aws-sdk authorisation part, since it works when I pass the token obtained via the Auth.signIn()

Here is my current arguments for the amplify Amplify.configure()

export default {
  region: process.env.VUE_APP_AWS_DEFAULT_REGION,
  userPoolId: process.env.VUE_APP_COGNITO_USER_POOL_ID,
  userPoolWebClientId: process.env.VUE_APP_COGNITO_WEB_CLIENT_ID,

  oauth: {
    domain: process.env.VUE_APP_COGNITO_OAUTH_DOMAIN,
    scope: ['email', 'openid'],
    redirectSignIn: process.env.VUE_APP_BASE_URL,
    redirectSignOut: process.env.VUE_APP_BASE_URL,
    responseType: 'code'
  }
}

user_13928594 · Answer

Auth.signIn() and Auth.federatedSignIn() return different things, you can look into source for Auth Amplify in Github to see.

Basically federatedSignIn return credentials and attributes from Attribute mapping while signIn return a Cognito user, token, session, ...

So asking Auth.federatedSignIn() to return the same as Auth.signIn() is impossible no matter how you try to configure it.

amplify federatedSignIn returns accessToken without scopes

1 Answers