AWS Amplify auth for authenticated user returns NotAuthorizedException identity [identityId] is forbidden

Question

I have implemented Amplify's Auth authentication in my react native app, and set up userpool identity pool to use PubSub.
The problem i'm facing is in the identity pool I've setup Identity providers as the user pool i'm signing into, and in the identity pool there is a role for Authenticated users and Unauthenticated users, after logging into the user pool I'll have to use the pubsub feature, but when I signin, I'll get [NotAuthorizedException] identity [identityId] is forbidden, the identity id is the id that's visible in my identity pool, also in the error console, I assume that the identity is set by the identity pool after the user signs in successfully, also if I sign in, the user will be assigned as an Authenticated user in the identity pool, but to test, I removed the identity provider from the identity pool, that means now if I sign in to the application using the same user pool, the identity pool does not recognise the user based on the user pool, rather it'll just assign the user/ identity as unauthenticated user, now to test I set the same role for both authenticated and unauthenticated users, with the identity providers set to the user pool I'll get the error, but with the unautheticated user/guest user with the same role which has access to the AWS IoT Core (by removing the identity provider in the identity pool), I'm able to access the aws iot core, which means I can now publish and subscribe, based on research, and Amazon Q's suggestions, I think I am missing in the Amplify's documentation is to pass the appropriate tokens to the identity pool from the user pool after signing in, share the references/ documentations if possible, also, is this the right approach of what I'm thinking?
Let me know. Thanks in advance!.

```

//index.ts
import { registerRootComponent } from "expo";

import App from "./App";

import { AWSIoTProvider } from "@aws-amplify/pubsub";
import { Amplify, Auth } from "aws-amplify";

Amplify.configure({
  Auth: {
    identityPoolId: "us-west-2:identity-pool-id",
    region: "us-west-2",
    userPoolId: "us-west-2_user-pool-id,
    userPoolWebClientId: "user-pool-app-client-id",
    mandatorySignIn: false,
    authenticationFlowType: "USER_PASSWORD_AUTH",
    signUpVerificationMethod: "code",
  },
});

Amplify.addPluggable(
  new AWSIoTProvider({
    aws_pubsub_region: "us-west-2",
    aws_pubsub_endpoint:
      "wss://domain-ats.iot.us-west-2.amazonaws.com/mqtt",
  })
);

export const currentConfig = Auth.configure();
```

```
import { Auth, PubSub } from "aws-amplify";
import { useEffect, useState } from "react";
import {
  Button,
  ScrollView,
  StyleSheet,
  Text,
  TextInput,
  TouchableOpacity,
  View,
} from "react-native";
import { currentConfig } from ".";

function SignUp({ onSignUpSuccess }: any) {
  const [form, setForm] = useState({
    username: "",
    password: "",
    email: "",
    phoneNumber: "",
    confirmationCode: "",
  });
  const [isConfirming, setIsConfirming] = useState(false);

function handleChange(field: string, value: string) {
    setForm((prev) => ({ ...prev, [field]: value }));
  }

async function handleSignUp() {
    try {
      await Auth.signUp({
        username: form.username,
        password: form.password,
        attributes: { email: form.email, phone_number: form.phoneNumber },
      });
      setIsConfirming(true);
    } catch (error) {
      console.log("Error signing up:", error);
    }
  }

async function handleConfirmSignUp() {
    try {
      await Auth.confirmSignUp(form.username, form.confirmationCode);
      onSignUpSuccess();
    } catch (error) {
      console.log("Error confirming sign up:", error);
    }
  }

return (
    
  );
}

function SignIn({ onSignInSuccess }: any) {
  const [username, setUsername] = useState("");
  const [password, setPassword] = useState("");

async function handleSignIn() {
    try {
      const user = await Auth.signIn(username, password);

console.log({ currentConfig });

const currentSession = await Auth.currentUserCredentials();
      console.log(currentSession, "current user creds");

onSignInSuccess(user);
    } catch (error) {
      console.log("Error signing in:", error);
    }
  }

return (
    
  );
}

function Home({ onSignOut }: any) {
  const [subscription, setSubscription] = useState(null);
  const [publishTopic, setPublishTopic] = useState("welds");
  const [subscribeTopic, setSubscribeTopic] = useState("welds");
  const [message, setMessage] = useState("");
  const [subscribedMessages, setSubscribedMessages] = useState([]);

useEffect(() => {
    setupIoT();

return () => {
      if (subscription) {
        subscription.unsubscribe();
      }
    };
  }, []);

const handlePublishTopicChange = (newTopic: string) => {
    setPublishTopic(newTopic);
    if (subscription) {
      subscription.unsubscribe();
    }
    setupIoT();
  };

const handleSubscribeTopicChange = (newTopic: string) => {
    setSubscribeTopic(newTopic);
    if (subscription) {
      subscription.unsubscribe();
    }
    setupIoT();
  };

const clearMessages = () => {
    setSubscribedMessages(() => []);
  };

return (

Varunprakash Shanmugam · Answer

You need to manually federate the user identity after signing in, like this:

```
import { Auth } from 'aws-amplify';

async function federateToIdentityPool() {
  const user = await Auth.currentAuthenticatedUser();
  const jwt = user.signInUserSession.idToken.jwtToken;

await Auth.federatedSignIn(
    'cognito-idp.us-west-2.amazonaws.com/your-user-pool-id',
    { token: jwt, expires_at: Date.now() + 3600 * 1000 },
    user
  );
}
```
Call this function after sign-in, before using `PubSub`.

Update your `handleSignIn` function:

```
async function handleSignIn() {
  try {
    const user = await Auth.signIn(username, password);

const jwt = user.signInUserSession.idToken.jwtToken;

await Auth.federatedSignIn(
      'cognito-idp.us-west-2.amazonaws.com/your-user-pool-id',
      { token: jwt, expires_at: Date.now() + 3600 * 1000 },
      user
    );

const currentSession = await Auth.currentUserCredentials();
    console.log(currentSession, "current user creds");

onSignInSuccess(user);
  } catch (error) {
    console.log("Error signing in:", error);
  }
}
```

AWS Amplify auth for authenticated user returns NotAuthorizedException identity [identityId] is forbidden

Add your answer

Relevant content