Aws-sdk-js: Signup with custom attributes in Cognito user pools

[JakubMatejka]

Hi,
I am writing lambda function for user signup and I can't manage to save custom attribute to the user. When I save the user with standard attributes only, it works fine but when I add the custom one, it fails with: NotAuthorizedException: A client attempted to write unauthorized attribute. My code looks like this (vendor is the custom attribute):

var provider = new aws.CognitoIdentityServiceProvider();
provider.signUp({
  ClientId: process.env.COGNITO_USER_IDENTITY_POOL_CLIENT_ID,
  Username: event.email,
  Password: event.password,
  UserAttributes: [
    {
      Name: 'email',
      Value: event.email
    },
    {
      Name: 'name',
      Value: event.name
    },
    {
      Name: 'vendor',
      Value: event.vendor
    }
  ]
}, function(err, data) {
  return callbackLocal(err);
});

My user pool setup looks ok:

I am just confused with the custom: prefix little bit but the code doesn't work when I put { Name: 'custom:vendor', Value: event.vendor } to the UserAttributes neither.

I couldn't find any example using custom attributes and sdk documentation does not say anything special about them so I guess it should work the same way as standard ones. I use sdk 2.4.11 running the labda function locally on node 5.10.1 with serverless 0.5.6

[JakubMatejka]

It looks that I can't write optional standard attributes neither. When I try to set profile or locale in UserAttributes I get the same error as with the custom attribute.

[chrisradek]

@JakubMatejka
Your custom UserAttributes should have the custom: prefix when setting their name field.

Other than that, can you confirm if your user pool client has write permissions for the fields you're trying to update? In the console, you can list the apps that can connect to your user pool. Check the write permissions for one that you're seeing that error with.

[JakubMatejka]

Oh I totally overlooked this setting of write permissions per client. Thanks a lot Chris.

[crivera]

hi ... where do i set the write permissions? in IAM?

[benhulan]

@crivera Write permissions can be set in your AWS Cognito users console. Select your user pool, then go to Apps. Select your app (if you have more than one), click the "Show Details" button and you will see the link to "Set attribute read and write permissions"

[starqueue]

I blew several hours on this - it should be clearly explained in the documentation that these permissions need to be set.

[dm-grinko]

AWS Console > User Pool > General settings > App Clients > Show details > Set attribute read and write permissions.
Mark your custom attributes.
Hope it saves time for someone.

[thatshailesh]

@dm-grinko Even with permissions set in app clients, I am getting this error

[jplew]

for the visual types out there...

[annjawn]

Wow.... Then this document is completely misleading... - https://aws.amazon.com/blogs/mobile/aws-amplify-adds-support-for-custom-attributes-in-amazon-cognito-user-pools/ it doesn't even mention the custom: prefix part. I followed this doc and kept getting the error like @JakubMatejka and prefixing it solved the issue. The only thing is that the Object format can be much simple like below instead of the "Name" "Value" type pairs-

'attributes': {
        'email': '[email protected]',
        'custom:favorite_flavor': 'Cookie Dough'  // custom attribute, not standard
        'custom:age': 25             // custom attribute, not standard
    }

[YaswanthC]

You comment really helpful @annjawn :) . Do you have any idea how to extract the field , in the documentation

try {
  const { favorite_flavor } = await Auth.currentUserInfo();
alert("hi" + favorite_flavor)
} catch (err) {
  console.log('error fetching user info: ', err);
}

Where in the const do i need to replace favorite_flavor with custom:favorite_flavor because i tried both but i didn't get any value.

Thanks

[annjawn]

@YaswanthC Auth.currentUserInfo(); returns a Cognito User object in this format-

{
  id: '2b3d-6da3-852b-ac1c5dc45dcd',
  username: '[email protected]',
  attributes: {
    "email" : "[email protected]",
    "custom:favorite_flavor" : "Peach",
  }
}

so you will have to do this-

const { attributes } = await Auth.currentUserInfo();
const flavor = attributes['custom:favorite_flavor'];

[rickydo]

Wow.... Then this document is completely misleading... - https://aws.amazon.com/blogs/mobile/aws-amplify-adds-support-for-custom-attributes-in-amazon-cognito-user-pools/ it doesn't even mention the custom: prefix part. I followed this doc and kept getting the error like @JakubMatejka and prefixing it solved the issue. The only thing is that the Object format can be much simple like below instead of the "Name" "Value" type pairs-

'attributes': {
        'email': '[email protected]',
        'custom:favorite_flavor': 'Cookie Dough'  // custom attribute, not standard
        'custom:age': 25             // custom attribute, not standard
    }

Holy Canoly!
I spent so many hours pulling my hairs out wondering why I kept getting the unauthorized message when the user pool had the appropriate permissions; adding in the 'custom' part solved it. @annjawn You are right! I followed the same thing.

[eibay]

Thanks to this thread, it helps me resolve the same issue with regards to custom attribute. My additional note would be to make sure you are setting the right 'app client' for read / write permissions.

The one that I am having difficulty now is getting my required standard attribute such as 'family_name' and 'given_name' to show up which is weird. In spite of all the changes needed above, this time around, it's the standard attribute that is not showing up. Even from the user's detail page at cognito pool, I couldn't see it even though I know that there's value because I can signup on my form without any issue.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.