护照-Google-Auth + AWS Cognito + Node.js

Question

I am using passport-google-auth to authenticate google users, and it returns me access_token that I am using to get aws Cognito credentials, but it throws an error:

NotAuthorizedException: Invalid login token. Not a valid OpenId Connect identity token.

my code snippet:

passport.use(new GoogleStrategy(googleDeveloperDetails, getUserDetails));

app.get("/auth/google", passport.authenticate("google", { scope: ['email'] }));

var authGoogle = passport.authenticate("google", {
failureRedirect: "/auth/google"
});

  app.get("auth/google/callback", authGoogle, controller.successRedirect);

 getUserDetails = function(accessToken, refreshToken, params, profile, done) {        
    profile.token = accessToken;      
    done(null, profile);
}

googleDeveloperDetails = {
    clientID: "google cleint ID",
    clientSecret: "google client secret",
    callbackURL: "https://localhost:3000/auth/google/callback",
    profileFields: ["emails", "profile"]
}

Answer 1

Solved

Solved by using params.id_token which is received from Google. Google passport returns accessToken, refreshToken and params.id_token, after searching and reading open-id-connect providers I got the solution.

Here's the solution:

passport.use(new GoogleStrategy(googleDeveloperDetails, getUserDetails));

app.get("/auth/google", passport.authenticate("google", { scope: ['email'] }));

var authGoogle = passport.authenticate("google", {
    failureRedirect: "/auth/google"
});

app.get("auth/google/callback", authGoogle, controller.successRedirect);

getUserDetails = function(accessToken, refreshToken, params, profile, done) {
  if(profile.provider == "google") {
        // params.id_token to be used to get cognito credentials
        profile.token = params.id_token;   
  } else {
        profile.token = accessToken;
  }
  done(null, profile);
}

googleDeveloperDetails = {
   clientID: "google cleint ID",
   clientSecret: "google client secret",
   callbackURL: "https://localhost:3000/auth/google/callback",
   profileFields: ["emails", "profile"]
}