amplify-js: FR: Auth components don't support scopes

Is your feature request related to a problem? Please describe. I’m using the provided react components to build the auth flow (@aws-amplify/ui-react). Unfortunately there doesn’t seem to be any possibility to request a scope on authentication. So it’s currently impossible to use this library for proper authentication.

Similar issues (closed without any reason): aws-amplify/amplify-js#3732 aws-amplify/amplify-js#1370. -> That issue already exists for years now

Describe the solution you’d like Hosted-UI supports this. But that is not an option for us. Would be great to pass the same configuration to the react components.

scope: ["email", "profile", "openid", "weather:read"],

Describe alternatives you’ve considered Unfortunately I don’t see any alternative solution possible with amplify-js.

-> I would really like to use this lib as it saves a ton of work. Thanks for that! Hope you can provide that feature (fix that bug 😉) soon 👍

About this issue

Original URL
State: open
Created 4 years ago
Reactions: 64
Comments: 16 (3 by maintainers)

Commits related to this issue

Merge pull request #237 from aws-amplify/pr/repo-sync Sync amplify-ui to amplify-ui-staging — committed to aws-amplify/amplify-ui by ayush987goyal 2 years ago

Most upvoted comments

I ran into this very issue today. I’m using Vue.js but it’s the same problem. The custom UI used by Amplify’s UI components implements the USER_SRP_AUTH flow. This flow is completely separate from the OAuth 2.0 flows. As a result, the access token I get back looks like this:

{
  "sub": "992b512f-130d-4da6-a9d3-a1a4227f82f5",
  "event_id": "e856b86d-7f44-46a8-8e02-4345ed1a6755",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1588775410,
  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_pNZrsdff",
  "exp": 1588782931,
  "iat": 1588779331,
  "jti": "000c94e0-9247-4f1e-ac0c-7aeb065d37f9",
  "client_id": "5gha7s6vka4qapbeape5i9resj",
  "username": "422b512f-130d-4da6-a9d3-a1a4117f82f5"
}

Notice the scope above.

When I try to invoke my HTTP API (not using REST) with a Cognito authorizer, passing the access token, I get the error: Bearer scope="email" error="insufficient_scope" error_description="expected scopes within the token".

Is the solution to use the Cognito hosted UI where we can get OAuth 2.0 scopes? If so, does that represent a compatibility issue with things like the Storage API (e.g. Storage.get())?

mrichman on May 6, 2020

Whoever is the manager of amplify or cognito big kudos really 🎉 There are so many bugs that TOTALLY block an essential use case and you find them out after you think you are done with the application and the last thing to use is custom scopes and you just CAN’T.

Thank you, people. Really.

Can-Sahin on Jan 12, 2023

Hello everyone, we are looking forward to adding support for scopes for the Authenticator component in the future. Currently we are blocked on this feature until aws-amplify is able to support scopes for Auth (see sibling feature request here). We realize this is important for you, and we will keep this issue updated when we have progress!

calebpollman on Jan 31, 2023

Did anyone use amazon-cognito-identity-js? In the changelog they mentioned custom scopes but I can’t see a hint how to define them. Anybody used this as alternative and get a token with access to API Gatway with cognito?

andreashe on Dec 7, 2021

We also have this as sticking point. We are liking using the React Amplify components but really would like the scopes returned. For now we are using the hosted UI which isn’t the best user experience and defeats the purpose of the Amplify components.

devallish on Sep 23, 2021

Did anyone find a solution or workaround to this???

I have resorted to using the @aws-sdk (which has the absolute worst authentication flow) to get the correct token from cognito then use Amplify for my API Gateway requests. It’s rather stupid because then what’s the point of Amplify??? It doesn’t really make sense how the hosted UI and the Auth.signIn both use the same code (or so it seems) but somehow they get different scopes!?

Can we get feedback from contributors on what the reason for this issue is and if there are any mitigations because this one issue makes Amplify absolutely useless to anyone using cognito without hosted UI.

ash0x0 on Apr 23, 2021

5 months later but still no feedback here 👎 . FYI: new developer run into this each day that just start using libraries in this repo.

dhensen on Aug 16, 2021