- Newest
- Most votes
- Most comments
To support both Cognito Email+Password and Sign In With Apple managed logins in the same user pool while addressing the issue you're experiencing, you can take the following approach:
-
Remove the requirement for the "name" attribute in your user pool. This will resolve the error you're seeing with Apple Sign In for returning users.
-
For your Cognito Email+Password app client, you can still collect the name during sign-up by customizing the sign-up form. Even though the name won't be a required attribute at the user pool level, you can configure your app client to request and collect this information.
-
For the Sign In With Apple app client, you won't need to prompt for the name after the initial sign-in, as Apple provides this information only on the first authentication.
-
To ensure you get the name for new Cognito users, you can use Lambda triggers to customize the sign-up process. Specifically, you can use the Pre Sign-up Lambda trigger to make the name a required field for your Cognito Email+Password flow, even though it's not required at the user pool level.
-
For your existing Google federation, you should be able to map the name attribute from Google to your user pool without issues.
By implementing these changes, you'll be able to:
- Support Sign In With Apple without errors for returning users
- Continue to collect names for new Cognito Email+Password users
- Maintain your existing Google federation
This approach allows you to have different requirements for different identity providers within the same user pool, giving you the flexibility to handle the varying behaviors of each provider while still collecting the information you need for your application.
Sources
User pool sign-in with third party identity providers - Amazon Cognito
Configuring identity providers for your user pool - Amazon Cognito
Amazon Cognito user pools - Amazon Cognito
I'm facing the same issue with Apple sign in. Instead of providing these vague responses from re:Post Agents it'd be nice to get actual feedback on this. For example there's no such thing as "Remove the requirement for the name attribute in your user pool", you cannot remove a required attribute once a pool is created, and this is a bottleneck for a lot of people out there. The only way this can be fixed is if we create a new user pool and migrate all users which is an enormous task, but of course AWS / Apple won't give a f about that.
The name requirement cannot be removed from the user pool. The user pool has to be rebuilt. I tried to add a prompt for name by customizing the login page, As far as I could tell, customization is limited to decorative elements like fonts and colors. I could not find a way to change the structure of the page and include a new field to be completed by the user.