Amplify-js: Auth.currentCredentials sometimes does not return identityId

[maxflores]

Describe the bug
For federated login, Auth.currentCredentials returns null identityId. Similar issues have been closed in the past but this is not fixed yet.

Expected behavior
identityId should be returned

System:
OS: Linux 4.19 Debian GNU/Linux 10 (buster) 10 (buster)
CPU: (2) x64 AMD EPYC 7571
Memory: 2.05 GB / 3.81 GB
Container: Yes
Shell: 5.0.3 - /bin/bash
Binaries:
Node: 14.5.0 - /usr/bin/node
Yarn: 1.22.4 - /usr/local/bin/yarn
npm: 6.14.5 - /usr/bin/npm
npmGlobalPackages:
npm: 6.14.5
yarn: 1.22.4

[maxflores]

This is a major issue and I don't see a workaround. For those that depend on credentials with identityId, the entire amplify javascript library is rendered useless until this is fixed.

[amhinson]

Would you be able to provide some reproduction steps to show this behavior?

[maxflores]

I used the Authenticator object from the aws-amplify-react library

After signing in with Facebook or Google using federated sign in (Cognito Identity Pool only), I see that the identity is created in my identity pool.

Then I call Auth.currentCredentials using Auth from the aws-amplify library

This works perfectly using [email protected] and [email protected]. However, using the current versions gives me only partial credentials. In the case of email and password login (i.e. Cognito User Pool + Cognito Identity Pool) there is no issue.

[mrowles]

I am also seeing this over the last 24 hours. It happened in an app that had no updates in the last fortnight, so it seems to be a Cognito issue.

Here is my function (using typescript + observables):

export function currentUnauthenticatedSession(): Observable<GetOpenIdTokenResponse> {
  return fromPromise(Auth.currentCredentials()).pipe(
    mergeMap((credentials: ICredentials) => {
      // credentials exists, identityId does not
      if (!credentials || !credentials.identityId) {
        throw new Error('Unable to get credentials for unauthorised session');
      }

      const openIdParams: GetOpenIdTokenInput = {
        IdentityId: credentials.identityId
      };
      const options: CognitoIdentity.Types.ClientConfiguration = {
        region: process.env.AWS_REGION,
        credentials
      };
      const cognitoIdentity = new CognitoIdentity(options);

      return fromPromise(
        cognitoIdentity.getOpenIdToken(openIdParams).promise()
      ).pipe(
        mergeMap(
          (openIdTokenResponse: CognitoIdentity.GetOpenIdTokenResponse) => {
            return of(openIdTokenResponse);
          }
        ),
        catchError(err => throwError(err))
      );
    }),
    catchError(err => throwError(err))
  );
}

Can we please get some sort of an update? @amhinson

[mrowles]

This was solved by reverting from aws-amplify@3x to aws-amplify@2x. We were live with 3x for a little while, so I'm not sure how the break came about, nevertheless reverting back to 2x fixes this. Thanks @maxflores

[randalb1991]

The same issue with the version 3.0.24

[rdsedmundo]

Also seeing this on v3.3.3, got the AWS credentials normally but no identityId anywhere. I can see in the network tab that the Cognito response returned the identityId (which I can also see in the AWS Console), so something is wrong while saving/retrieving it.

[mllrmat]

The identityId is lost when the token is refreshed. Looking at the code the identityId is not passed to the refresh function:

See: https://github.com/aws-amplify/amplify-js/blob/abb5e3605e21685c98959af67115fa6a37bf22f2/packages/core/src/Credentials.ts#L148