Feature Request: Cognito "InitiateAuth" request allowed custom "scopes" in AccessToken

[tomjanne]

To help us solve your problem better, please answer the following list of questions.

• What service are you using?
  AWS Cognito

Hello,

we are currently using a Cognito User Pool for authenticating our Application Users. These are accessing an Amazon API Gateway secured by a Cognito Authorizer with OAuth (custom) scopes.

At first we tried using the Android sdk from your Documentation
https://docs.aws.amazon.com/cognito/latest/developerguide/tutorial-integrating-user-pools-android.html

But then we were facing the issue, that we have no possibility to define a "scope" parameter to retrieve also other custom scopes in the "AccessToken" returned by the CognitoUserSession. In the returned access token is always set the "aws.cognito.signin.user.admin" as scope paramater only.

After some further looking into the SDK, we found out, that the API call is done with the InitateAuth action and the AuthFlow USER_SRP_AUTH.
https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html

Would it be possible to request also a custom "scope" to be set in the AccessToken which is enabled for the given ClientId.
For example something like this for the InitiateAuth action:

{
"AnalyticsMetadata": {
"AnalyticsEndpointId": "string"
},
"AuthFlow": "string",
"AuthParameters": {
"string" : "string"
},
"Scope": "string",
"ClientId": "string",
"ClientMetadata": {
"string" : "string"
},
"UserContextData": {
"EncodedData": "string"
}
}

I know we could do it using the Cognito Auth SDK (aws-android-sdk-cognitoauth) following the OAuth 2 Flow with browser redirection. But we wanted to do it in-app without popping to the browser.

With kind regards
Tom Janne

[dercdev]

Hi,
sorry that I can't help you with that, but i am also interested in an answer. I am in a similar situation and would like to add custom elements to the scope of the access token.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[Beretta1979]

Can a solution be provided? Thank you

[minbi]

Hi @dercdev @Beretta1979 @tomjanne ,

In the Auth builder you should be able to set scopes code line

The scopes that are allowed to be requested are set in the Cognito console.

phone
email
openid
aws.cognito.signin.user.admin
profile

Code:

final Set<String> scopes = new HashSet<>();
scopes.add("phone");
final Auth auth = new Auth.Builder().setScopes(scopes)....build();

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.

[zhenwenc]

bump

[jamesonwilliams]

@zhenwenc Please track #684

[rupertlssmith]

Seems to have been fixed on Cognito User Pools: https://aws.amazon.com/about-aws/whats-new/2023/12/amazon-cognito-user-pools-customize-access-tokens/