API Gateway Authorizer Accepts ID_token But Not Access

API Gateway Authorizer Accepts ID_token But Not Access_Token

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

I am using API Gateway and an Authorizer to control access to a folder in an S3 bucket. The Authorizer is configured to use a Cognito User Pool. This user pool has the OAuth Scopes phone and email associated with it and also a custom scope which I intend to grant read access to the S3 bucket.

I am finding however that the Authorizer will only accept the ID token to grant access and returns unauthorized if I pass the access token. According to the Amazon docs it should be possible to use an access token.

I have followed the direction given here when requesting an access token so for example I set up the auth variable like so:

var authData = {

        ClientId : '<removed>', 

        AppWebDomain : '<removed',

        TokenScopesArray : ['openid','email', 'domain.com/content/content.read'], 

        RedirectUriSignIn : '<removed>',

        RedirectUriSignOut : '<removed'

    }

I had assumed that an access token would be all that I required and that was its purpose but I cannot get it to work.

asked Nov 16 '18 at 21:51

Kerry

4,19764381

Is the problem occurring when making a request to the API gateway? If so, how are you passing the token in the request?

– bwest
Nov 16 '18 at 22:35

1

In the Authorization header. It works when the ID token is passed in but not the access token.

– Kerry
Nov 16 '18 at 23:08

add a comment |

I have followed the direction given here when requesting an access token so for example I set up the auth variable like so:

var authData = {

        ClientId : '<removed>', 

        AppWebDomain : '<removed',

        TokenScopesArray : ['openid','email', 'domain.com/content/content.read'], 

        RedirectUriSignIn : '<removed>',

        RedirectUriSignOut : '<removed'

    }

I had assumed that an access token would be all that I required and that was its purpose but I cannot get it to work.

asked Nov 16 '18 at 21:51

Kerry

4,19764381

Is the problem occurring when making a request to the API gateway? If so, how are you passing the token in the request?

– bwest
Nov 16 '18 at 22:35

1

In the Authorization header. It works when the ID token is passed in but not the access token.

– Kerry
Nov 16 '18 at 23:08

add a comment |

I have followed the direction given here when requesting an access token so for example I set up the auth variable like so:

var authData = {

        ClientId : '<removed>', 

        AppWebDomain : '<removed',

        TokenScopesArray : ['openid','email', 'domain.com/content/content.read'], 

        RedirectUriSignIn : '<removed>',

        RedirectUriSignOut : '<removed'

    }

I had assumed that an access token would be all that I required and that was its purpose but I cannot get it to work.

asked Nov 16 '18 at 21:51

Kerry

4,19764381

I have followed the direction given here when requesting an access token so for example I set up the auth variable like so:

var authData = {

        ClientId : '<removed>', 

        AppWebDomain : '<removed',

        TokenScopesArray : ['openid','email', 'domain.com/content/content.read'], 

        RedirectUriSignIn : '<removed>',

        RedirectUriSignOut : '<removed'

    }

I had assumed that an access token would be all that I required and that was its purpose but I cannot get it to work.

amazon-web-services amazon-s3 amazon-cognito

asked Nov 16 '18 at 21:51

Kerry

4,19764381

asked Nov 16 '18 at 21:51

Kerry

4,19764381

asked Nov 16 '18 at 21:51

Kerry

4,19764381

asked Nov 16 '18 at 21:51

Kerry

4,19764381

asked Nov 16 '18 at 21:51

Kerry

4,19764381

Is the problem occurring when making a request to the API gateway? If so, how are you passing the token in the request?

– bwest
Nov 16 '18 at 22:35

1

In the Authorization header. It works when the ID token is passed in but not the access token.

– Kerry
Nov 16 '18 at 23:08

add a comment |

Is the problem occurring when making a request to the API gateway? If so, how are you passing the token in the request?

– bwest
Nov 16 '18 at 22:35

1

In the Authorization header. It works when the ID token is passed in but not the access token.

– Kerry
Nov 16 '18 at 23:08

Is the problem occurring when making a request to the API gateway? If so, how are you passing the token in the request?

– bwest
Nov 16 '18 at 22:35

In the Authorization header. It works when the ID token is passed in but not the access token.

– Kerry
Nov 16 '18 at 23:08

add a comment |

1 Answer
1

active

oldest

votes

If you want to use API Gateway with an access token you have to jump through a few extra hoops.

For full details take a look at "Integrate an API with a User Pool", especially the section on configuring a COGNITO_USER_POOLS authorizer on methods.

Specifically, from the Method Request's Settings > Authorization:

Choose the pencil icon next to OAuth Scopes.

Type one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the
example given in Create an Amazon Cognito User Pool, one of the scopes
is com.hamuta.movies/drama.view. Use a single space to separate
multiple scopes.

To save the setting, choose the check mark icon.

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53345916%2fapi-gateway-authorizer-accepts-id-token-but-not-access-token%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

If you want to use API Gateway with an access token you have to jump through a few extra hoops.

For full details take a look at "Integrate an API with a User Pool", especially the section on configuring a COGNITO_USER_POOLS authorizer on methods.

Specifically, from the Method Request's Settings > Authorization:

Choose the pencil icon next to OAuth Scopes.

Type one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the
example given in Create an Amazon Cognito User Pool, one of the scopes
is com.hamuta.movies/drama.view. Use a single space to separate
multiple scopes.

To save the setting, choose the check mark icon.

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

add a comment |

If you want to use API Gateway with an access token you have to jump through a few extra hoops.

For full details take a look at "Integrate an API with a User Pool", especially the section on configuring a COGNITO_USER_POOLS authorizer on methods.

Specifically, from the Method Request's Settings > Authorization:

Choose the pencil icon next to OAuth Scopes.

Type one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the
example given in Create an Amazon Cognito User Pool, one of the scopes
is com.hamuta.movies/drama.view. Use a single space to separate
multiple scopes.

To save the setting, choose the check mark icon.

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

add a comment |

If you want to use API Gateway with an access token you have to jump through a few extra hoops.

For full details take a look at "Integrate an API with a User Pool", especially the section on configuring a COGNITO_USER_POOLS authorizer on methods.

Specifically, from the Method Request's Settings > Authorization:

Choose the pencil icon next to OAuth Scopes.

Type one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the
example given in Create an Amazon Cognito User Pool, one of the scopes
is com.hamuta.movies/drama.view. Use a single space to separate
multiple scopes.

To save the setting, choose the check mark icon.

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

If you want to use API Gateway with an access token you have to jump through a few extra hoops.

For full details take a look at "Integrate an API with a User Pool", especially the section on configuring a COGNITO_USER_POOLS authorizer on methods.

Specifically, from the Method Request's Settings > Authorization:

Choose the pencil icon next to OAuth Scopes.

Type one or more full names of a scope that has been configured when the Amazon Cognito user pool was created. For example, following the
example given in Create an Amazon Cognito User Pool, one of the scopes
is com.hamuta.movies/drama.view. Use a single space to separate
multiple scopes.

To save the setting, choose the check mark icon.

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

answered Nov 19 '18 at 9:42

thomasmichaelwallace

2,8601920

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

add a comment |

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

This feels like a face-palm moment. Although I had read the beginning of that page you linked I did not read the whole of it. I'll try that and see if that (most likely) fixes my issue.

– Kerry
Nov 19 '18 at 17:32

I have no end of time and sympathy for anyone attempting to make sense of Cognito documentation. AWS does not make it easy.

– thomasmichaelwallace
Nov 19 '18 at 17:33

Embarrassingly obvious really now .. there is a box for OAuth scopes right under the Authorization selection... but thanks. The AWS docs have all the information but I sometimes think the presentation could be better.

– Kerry
Nov 19 '18 at 17:58

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Vfrdtyky