AWS Cognito - How to force select account when signing in with Google

Question

I am using Cognito User Pools and `federatedSignIn({provider: 'Google'})` to have the user login using Google. The user may have multiple accounts with our application, and there is a high chance that they may use a work vs personal Google account to login.

Unfortunately, if the user has already logged into the application via Google, we're unable to force account selection for them to select a new one without calling the Cognito LOGOUT endpoint (which would kill their existing Google cookie with Cognito, which is what we don't want to do here).

A solution would have been to use Google's `prompt=select_account`, but there is no way to specify this in the `federatedSignIn()` call. There has been posts describing a "workaround" where you use the Google SDK directly to do the login with the parameter, then call `federatedSignIn()` with the Google Auth JWT, but that workaround does not work because that is specific to *identity pool* federation, which would not give you back the Cognito JWTs in the *user pool* federation scenario.

This is the non-working hack that users generally refer to:
- (The actual code for the hack) https://docs.amplify.aws/lib/auth/advanced/q/platform/js/#google-sign-in-react
- https://github.com/aws-amplify/amplify-js/issues/4044
- https://forums.aws.amazon.com/thread.jspa?messageID=980276&#980276
- https://stackoverflow.com/questions/58154256/aws-cognito-how-to-force-select-account-when-signing-in-with-google

It will not give you back the Cognito User Pool tokens.

Answer

Most of providers like OAuth and Google have the **prompt** parameter to force the account selection. Is there a way we can configure that from Cognito?
I mean, it would be as simple as adding this param to the auth URL when Cognito is building it, for example:
`https://accounts.google.com/o/oauth2/v2/auth?client_id=[...]&prompt=select_account`

I know many people is having this problem and moving to another Authentication system. Also amplify-js team was dealing with this and blocked because Cognito does not provide that option: https://github.com/aws-amplify/amplify-js/issues/4044

Answer

The solution to this is to use Google as an OpenID authentication provider for your user pool in Cognito.

Here is a stack overflow answer I just wrote.https://stackoverflow.com/a/75291833/13889098

AWS Cognito - How to force select account when signing in with Google

Relevant content