Amazon Cognito - OpenID Connect - Invalid+ProviderName/Username+combination

user_9897083 0
Viewed 784

I am trying to configure the Microsoft Azure AD B2C identity provider in my Cognito user pool.

I am using the https://www.npmjs.com/package/@aws-amplify/auth library on my front-end.

I have named the new identity provider Microsoft. I have also enabled it on my user pool. And I am passing the same (Microsoft) to the Auth.federatedSignIn method.

Now, when I try to authenticate the user with Microsoft, the user gets authenticated from the Microsoft side but the Cognito gives me the ?error_description=Invalid+ProviderName/Username+combination.+Please+check+again+&state=XmnGedOhmT99RnTlw0LypyMmqwCRbCZr&error=invalid_request error.

This seems like a configuration issue to me but I am unable to figure out what is it.

Please help.

aws-amplify-sdk-js amazon-cognito amazon-web-services
1 Answers

After some time we managed to resolve this issue. The problem was that the user is linked with ProviderAttributeValue to lower case, but in the sub claim from the OIDC provider there are capital letters, and that's where the whole confusion was coming from. If the user is linked with the original value provided from the sub claim everything works fine

https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html

{
   "DestinationUser": { 
      "ProviderAttributeName": "string",
      "ProviderAttributeValue": "string",
      "ProviderName": "string"
   },
   "SourceUser": { 
      "ProviderAttributeName": "string",
      "ProviderAttributeValue": "string" //ensure that value is same as in sub claim,
      "ProviderName": "string"
   },
   "UserPoolId": "string"
}
user_84598100
Related