CODEWITHSUNDEEP
amazon-web-servicesauthenticationamazon-cognitoserverless
Ursula Raab
Ursula Raab

Reputation: 41

Cognito Userpool as identy provider with client credentials works only after saving in aws console

I'm deploying a serverless application in aws with the serverless framework. I was setting up AUTH2 with a cognito userpool and client credential authentication. After the deployment it's not working, I get the error invalid grant, when I request a new token via postman. When i login into the aws console, open the cognito app client page (refresh the page) and click the "save" button (without changing anything), it works. I can request as access token and can login into my app. It works until my next deployment, so automatic deployment is not possible. What could be the reason? What happens when I click the save button? This is my deployment code

resources:

Resources:

UserPoolDomain:
  Type: AWS::Cognito::UserPoolDomain
  Properties:
    UserPoolId:
      Ref: CognitoUserPool
    Domain: "myapp-user-pool-domain"

CognitoUserPool:
  Type: "AWS::Cognito::UserPool"
  Properties:
    MfaConfiguration: OFF
    UserPoolName: myapp-user-pool
    AdminCreateUserConfig:
      AllowAdminCreateUserOnly: true
    UsernameAttributes:
      - email


CognitoUserPoolClient:
  Type: "AWS::Cognito::UserPoolClient"
  Properties:
    ClientName: myapp-user-pool-client
    GenerateSecret: True
    UserPoolId:
      Ref: CognitoUserPool
    AllowedOAuthFlows: [ "client_credentials"]
    ExplicitAuthFlows: ["ALLOW_USER_PASSWORD_AUTH","ALLOW_REFRESH_TOKEN_AUTH" ]
    SupportedIdentityProviders: [ "COGNITO" ]
    AllowedOAuthScopes: [ "myapp/odata4","myapp/trigger" ]
    PreventUserExistenceErrors: ENABLED

ApiGatewayAuthorizer:
  DependsOn:
    - ApiGatewayRestApi
  Type: AWS::ApiGateway::Authorizer
  Properties:
    Name: cognito-authorizer
    IdentitySource: method.request.header.Authorization
    RestApiId:
      Ref: ApiGatewayRestApi
    Type: COGNITO_USER_POOLS
    ProviderARNs:
      - Fn::GetAtt: [ CognitoUserPool, Arn ]

UserPoolResourceServer:
  Type: AWS::Cognito::UserPoolResourceServer
  Properties:
    UserPoolId:
      Ref: CognitoUserPool
    Identifier: "myapp"
    Name: "myapp"
    Scopes:
      - ScopeName: "results"
        ScopeDescription: "provides myapp results"
      - ScopeName: "trigger"
        ScopeDescription: "trigger for myapp start"

Who can help? Thanks

Upvotes: 1

Views: 656

Answers (1)

Ursula Raab
Ursula Raab

Reputation: 41

The following line has to be added to CognitoUserPoolClient: AllowedOAuthFlowsUserPoolClient: True. Then it works.

Upvotes: 3

Related Questions