amazon-web-servicesamazon-cognitogoogle-authentication

Missing userAttributes for federated Google User


I'm trying to integrate Google as an IdP in our existing Cognito UserPool. Everything is set up so far, and I can SignUp/SignIn using Google, which creates the new user. I'm using the PreSignUp Lambda trigger to Link an existing user or create a new native one if there's no existing one. Now I was expecting that the event.Request.UserAttributes['name'] contains the user's name as provided by Google or at least seeing the attribute in the id_token. But I see no possibility to get those values at the moment. We started using Cognito just as the store for username/password, and none of the userAttributes are filled nor marked as required.

I have set up the Google integration with the following scopes:

In the UserPoolClient I:

In the Federation section, I configured the attribute mapping: Attribute mapping for Google in Cognito

Testwise, I mapped the name attribute to a custom attribute I used to test stuff. But neither this nor the mapping name to name worked.

Payload I get in the event:

{{PreSignUp_ExternalProvider .... Google_11...} {map[cognito:email_alias: cognito:phone_number_alias: email:m...@...m email_verified:true] map[] map[]} {false false false}}

id_token content:

{
  "at_hash": "..",
  "sub": "52...",
  "email_verified": true,
  "iss": "https://cognito-idp.us-west-2.amazonaws.com/...",
  "cognito:username": "52..",
  "origin_jti": "..",
  "aud": "...",
  "identities": [
    {
      "userId": "11...",
      "providerName": "Google",
      "providerType": "Google",
      "issuer": null,
      "primary": "false",
      "dateCreated": "1648828708886"
    }
  ],
  "token_use": "id",
  "auth_time": 1648828717,
  "exp": 1648830828,
  "iat": 1648830228,
  "jti": "...",
  "email": "m...@...m"
}

access_token content:

{
  "origin_jti": "02...",
  "sub": "52...",
  "token_use": "access",
  "scope": "openid profile",
  "auth_time": 1648828717,
  "iss": "https://cognito-idp.us-west-2.amazonaws.com/....",
  "exp": 1648829317,
  "iat": 1648828717,
  "version": 2,
  "jti": "..",
  "client_id": "...",
  "username": "52..."
}

Solution

  • Now it's working, even though I cannot state the error. I recreated the whole test set again and ensured the correct values of the following:

    I added the scopes email, profile, and openid to be sure, and now I get the name attribute within the pre signup trigger lambda and in the ID-Token.