Generic "Invalid Code" or "User not found" error when implementing SSO workaround for Amazon Cognito

0

Due to an issue with the PreSignUp trigger and AdminLinkProviderForUser command, I am following the workaround described by an AWS support engineer in the linked re:Post forum to implement single sign-on for my application that uses Amazon Cognito.

https://repost.aws/questions/QULY1qbV21TYqrnVnNdpdpqQ/remove-external-identity-from-cognito-user

The TL:DR of the workaround above is that the AdminLinkProviderForUser command is used in the PostConfirmation trigger. However to do this, we first have to delete the automatically created external IdP user to prevent the command from throwing an error.

Depending on which OAuth flow that I choose for single sign-on, such as the authorization code, or the implicit grant, I get an 'invalid code' or 'user not found' error instead of receiving the JWT tokens that I need for my application when applying this workaround. I suspect that the error is because I delete the user that the authorization token or the implicit grant is supposed to be for, but then how did the AWS support engineer successfully retrieve JWT tokens back?

Has this been an issue with anyone else? I'm fairly certain I implemented everything in the same manner (except that it is written in JavaScript), but I just simply cannot get it to work.

P.S. Any updates on fixing the SSO bug from any AWS employees? More details about this bug described here: https://repost.aws/questions/QUgWVkIodQS1W3Yj8MYjInbA/cognito-auth-flow-fails-with-already-found-an-entry-for-username-username

已提問 2 年前檢視次數 269 次
1 個回答
0

Hi!! Did you found a work around for this issue. Im having the same issue trying to change de code using the oauth2/token endpoint.

smunoz
已回答 8 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南