AWS Cognito Federated Identity Pool - Role on Authentication

Question

I have 2 identity pools - one for Unauth (with only Unauth role set) and other for Federated Identities (FB and Google - with only Auth role set).

I have an iOS app in with 2 classes implementing AWSIdentityProviderManager protocol - GuestProvider which returns an empty logins and FBProvider which populates the FB token in logins.

When I launch the app and browse as guest, it works, Similarly if I launch the app and directly login to FB, it also works with proper auth role.

The problem comes when I login as Guest and then switch to FB - though I get the Auth token and set it in Provider and update the defaultServiceConfiguration, but Lambda invoke fails with AccessDenied error - logs show it still has the unauth role. This does not happen if I launch the app and login via FB (not going to Guest first).

These are the functions that set the AWS config for resp use case:

func initializeGuestCredentialsProvider() {
// AWS
credentialsProvider = AWSCognitoCredentialsProvider(
regionType: Constants.AWS_REGION,
identityPoolId: Constants.COGNITO_UNAUTH_IDENTITY_POOL_ID);

let configuration = AWSServiceConfiguration(
region: Constants.AWS_REGION,
credentialsProvider: credentialsProvider
);

AWSServiceManager.default().defaultServiceConfiguration = configuration
}

func initializeFBCredentialsProvider() {
credentialsProvider = AWSCognitoCredentialsProvider(
regionType: Constants.AWS_REGION,
identityPoolId: Constants.COGNITO_IDENTITY_POOL_ID,
identityProviderManager: FacebookProvider());

let configuration = AWSServiceConfiguration(
region: AWSRegionType.USWest2,
credentialsProvider: credentialsProvider
);

AWSServiceManager.default().defaultServiceConfiguration = configuration

}

I am not sure what could be the reason for this error. Possibly the first credentials provider that has been set in config, can not be changed ?

Answer 1

I would suggest using a single identity pool. When a user switches from Guest to Authenticated, then just pass the identityId and the provider token (in the logins map) to GetCredentialsForIdentity. This would link the same identityId to the provider (Facebook) user.