Amazon Cognito with iOS: Access to Identity Forbidden

Question

Thanks for the help in advance!

I am having some trouble getting Amazon Cognito to store/synchronize data properly.

On the dataset.synchronize() line (which does not store the data in Cognito), I get a large output error (with ID starred out) such as:

AWSCredentialsProvider.m line:429 | __73-[AWSCognitoCredentialsProvider 
getCredentialsWithCognito:authenticated:]_block_invoke |   GetCredentialsForIdentity
failed. Error is [Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain 
Code=10 "(null)" UserInfo={__type=NotAuthorizedException, message=Access to
Identity '*****' is forbidden.}]

The cognitoID is not nil, and returns properly (and matches the values I can read online)

For instance, after authenticating with Facebook, I perform the following:

  if (FBSDKAccessToken.currentAccessToken() != nil)
    {
        let fbCognitoToken = FBSDKAccessToken.currentAccessToken().tokenString
        credentialsProvider.logins = [AWSCognitoLoginProviderKey.Facebook.rawValue: fbCognitoToken]
        // Retrieve your Amazon Cognito ID
        credentialsProvider.getIdentityId().continueWithBlock { (task: AWSTask!) -> AnyObject! in
            if (task.error != nil) {
                print("Error: " + task.error!.localizedDescription)
            }
            else {
                // the task result will contain the identity id
                let cognitoId = task.result

                //checking if cognito was successful, if true, sets success condition to true to prepare for segue into app
                if cognitoId != nil{
                    print (cognitoId)
                    cognitoSuccess = true

                    let syncClient = AWSCognito.defaultCognito()

                    let dataset = syncClient.openOrCreateDataset("User_Data")
                    dataset.setString("test@test.com", forKey:"Email")
                //    credentialsProvider.refresh()
                    dataset.synchronize()
                    } }return nil}}

I can read data from Facebook correctly, and all authentication occurred correctly from what I can tell. I suspect there is something simple that is at the root here, but after spending several days, I cannot figure it out! Using the IAM checker in the AWS portal returns all "green checks" for Cognito functions, so I am sure this not a permissions issue on the server-side, either.

Thanks again for any insight you might have!

Edit: Before the chunk of code above, I call:

let credentialsProvider = self.initializeCognito()

which runs (identity pool ID starred out):

 func initializeCognito () -> AWSCognitoCredentialsProvider
{
    let credentialsProvider = AWSCognitoCredentialsProvider(
        regionType: AWSRegionType.USEast1, identityPoolId: "******")

    let defaultServiceConfiguration = AWSServiceConfiguration(
        region: AWSRegionType.USEast1, credentialsProvider: credentialsProvider)

    AWSServiceManager.defaultServiceManager().defaultServiceConfiguration = defaultServiceConfiguration

    return credentialsProvider     
}

Answer 1

That exception can be thrown when you're trying to get credentials for an authenticated id without giving any provider token linked to it. Cognito requires at least one to be given.

Can you check that you're including the facebook token during the GetCredentialsForIdentity call that's failing? If not, I'd guess that's your issue.

Edit:

Since you are using AWSCognito.defaultCognito(), it might help to follow the example on this docs page to make sure the sync client uses the right credentials provider:

let configuration = AWSServiceConfiguration(region: AWSRegionType.USEast1, credentialsProvider: credentialsProvider)

AWSServiceManager.defaultServiceManager().defaultServiceConfiguration = configuration

Answer 2

Ended up figuring out the answer-- when I first set up AWS and was following some of Amazon's guides, I had placed code to create a new credentialsProvider in the application's App Delegate. I forgot about it, and then was trying later on to initialize another credentialsProvider. This confusion created the issues, and removing the initialization in App Delegate fixed the authentication problems.