Filtering AWS-Cognito users by role

Question

I've been looking all day for how to do this to now avail.

Let's say I have two users in my User Pool, John Admin and Jim User. I have a view controller that I want to be accessible to John Admin but not Jim User. The problem is that I don't know how to distinguish John and Jim in my app.

Is there a way to know that John Admin is in my admin groups/role but Jim is not?

edit: Asking for user attributes gave me:

{"UserAttributes": [
  { "Name": "sub", "Value": "NUMBERS"},
  { "Name": "email_verified", "Value": "true"},
  { "Name": "phone_number_verified", "Value": "false"},
  { "Name": "phone_number", "Value": "NUMBERS"},
  { "Name": "email", "Value": "EMAIL"}],
 "Username": "johnadmin"}

Answer 1

I solved it using attributes, because IdentityID didn't show the groups embedded in as I thought.

var pool: AWSCognitoIdentityUserPool?
var user: AWSCognitoIdentityUser?

And within my method of interest:

if let strongUser = self.user {
    strongUser.getDetails().continueOnSuccessWith { (task) -> AnyObject? in
        DispatchQueue.main.async(execute: {
            if let response:AWSCognitoIdentityUserGetDetailsResponse = task.result {
                for attr in response.userAttributes! {
                    if attr.name == "custom:privilege", attr.value == "admin" {
                        self.adminButton.isHidden = false
                        return
                     }
                 }
             }
              self.adminButton.isHidden = true
        })
        return nil
    }
} else {
    adminButton.isHidden = true
}

The downside is that while not logged in, no custom attributes can be written to by the app, so I used the AWS-CLI to promote users:

aws cognito-idp admin-update-user-attributes --user-pool-id <POOLID> --username <USERNAME> --user-attributes '{"Name":"custom:privilege","Value":"admin"}'

Answer 2

Your User model should contain some property that will allow you to distinguish users by their roles. Eg

struct User {
   var name = ""
   var role = "User" // you can use enum here or anything else you want
}

After user got logged in you should set this property to proper value. Further before presenting view controller you should check this property and decide to show or not to show this view controller