Google sign in not being saved to user pool

[marclave]

when trying to integrate cognito google sign in userPool.getCurrentUser(); always returns null afterwards. I can see it is being registered in my identity pool but the doc's are not clear on the next steps

[marclave]

Looking through cognito sample applications, social sign in with pools seems to be a recurring feature request, and also even if not adding to pool how to integrate with an application that uses both the pool and social sign in would be useful.

[itrestian]

We added support for Federation through Facebook, Google and LoginWithAmazon for User Pools. This will create a user in user pool when a user logs in with federation. You can also capture the attributes from Facebook using the attribute mapping feature. More details http://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html .

[marclave]

@itrestian thanks for your reply!

I tried following the guide but had no luck(also noted I tried to find examples and other people posted similar issues getting started), a sample repo/example with an instructional readme would be quite helpful! 😃

[itrestian]

I meant more that we just released this today!

[marclave]

@itrestian Woah haha that's awesome! 🎉 I am guessing documentation/sample is coming up in the next couple days?

[prem911]

@itrestian This is an interesting addition beyond the SAML integration. I went through the documentation and have the following questions.

1. The auth success call back comes with ?code=xxxxxxxxx. What is this code and how do we proceed to know who is the logged in user?
2. In App Settings, callback url must be https. How do we then test apps running on localhost?
3. Say we have FB, Google and user pool in app integration and have completed the respective mapping of attributes. If a user using FB with email abc@gmail.com logs in, does it create a separate user in user pool when compared to a google login with the same email id?
4. If answer to userPool.signUp results in CredentialsError: Missing credentials in config #2 is yes, then how do we link them automatically based on email address?
5. I also saw that now either code and Link are being used to confirm the user ( I created a user pool user ). When the user clicks the "Verify Link", it takes him to another page, shows a congratulations page. In my opinion it should automatically take him to the signin page post successful verification. This will improve the usability of the signup-confirm-signin process. Else the user has to wade through different tabs to figure out how to sign in after confirmation. Can the confirmation page be customized?

[bennypowers]

Is OpenID provider integration on the roadmap? SAML is a pain.

[bennypowers]

Also the docs on this are... less than clear. In the authorization window at google / fb, Do I need to specify a redirect uri like https://cognito-identity.us-east-1.amazonaws.com/oauth2/idpresponse?

[prem911]

Docs have always been very limited and more so due to lack of examples. I m still waiting for the response from my earlier questions listed above

[itrestian]

@prem911 1. If you're using the authorization code grant flow, that code can be used against the token endpoint to issue tokens. Once you exchange that code for tokens, you can parse the username from the tokens. That's what the auth SDK does.
2. That's a good point. I will mention this use case within the team as a feature request.
3 & 4. Yes, separate users are created. There's no implicit linking, you would have to call the 'admin link provider for user' from your backend to link them based on common attributes.
http://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-link-provider-for-user.html
5. I will mention this within the team as a feature request for configuring this behaviour.

@bennypowers Supporting OIDC providers is on the roadmap. I cannot comment on the timeline.

[itrestian]

@bennypowers For google, you need to do that. For facebook no.

[ashutoshgarg0007]

hey can you post a link for how to add user to cognito user pool after i get token from facebook authentication using the facebook sdk. I am tired of finding a documentation for this. Any help would be appreciated. Thanks

[prem911]

@itrestian Thanks for the detailed reply. admin-link-provider-for-user looks like is available in AWS CLI only.
How to do using JS SDK?

[ashutoshgarg0007]

@prem911 are you able to add google / facebook user to cognito user pool because i think admin-link-provider-for-user is for linking social identity to existing user and not for creating the user.

[prem911]

@ashutoshgarg0007 The way I do is when a user logins with FB or G+ credentials, I read their public profile and create a user pool user using the admin api. This user gets a verification email and I handled the account activation using my application. I m stuck at auto linking from the social account to this user pool account.