Can Cognito Endpoint be changed without invalidating tokens?

[ndeka28]

We've been using the default endpont for our Cognito user pool but would like to start using a custom proxy endpoint (without changing the underlying pool). Also we want to remove credential provider config.

When updating an Amplify Android app's Config to:

1. Change the Cognito User Pool endpoint to a custom domain, and
2. Remove the Credentials Provider configuration,

existing signed-in users are automatically logged out at app launch.

Existing Config

                "CognitoUserPool": {
                    "Default": {
                        "PoolId": "eu-west-XXX",
                        "AppClientId": "xxxx",
                        "Region": "eu-west-1"
                    }
                },
                "CredentialsProvider": {
                    "CognitoIdentity": {
                        "Default": {
                            "PoolId": "eu-west-XXX",
                            "Region": "eu-west-1"
                        }
                    }
                },

New config we are aiming for

             "CognitoUserPool": {
                    "Default": {
                        "Endpoint": "idp.example.com",
                        "PoolId": "eu-west-1_**",
                        "AppClientId": "XXXX",
                        "Region": "eu-west-1"
                    }
                },

Recently Amplify-iOS SDK has similar issues, raised by our team members and it get resolved in a newer version 2.49.1

Here is Amplify-iOS similar issue link - aws-amplify/amplify-swift#4008 and here is the link to the fix - https://github.com/aws-amplify/amplify-swift/pull/4010/files#diff-c2bd9521d0dc38e3ddd27c89e7efadcfbf6450d05b80ecdfb1ee386ce140b1d3

Can Android SDK has similar approach or any other workaround, so that we can release our new changes?

Thanks

[tylerjroach]

HI @ndeka28 I wanted to first confirm that you have tested the Android implementation and are having the same issue described in Swift. I had worked with @harsh62 when we were reviewing the concern on Swift, and had believed that Android didn't have the same endpoint check that Swift did.

Can you add Amplify.addPlugin(AndroidLoggingPlugin(LogLevel.VERBOSE) to the top of configured Amplify plugins and provide logs for the first launch after the endpoint has changed.

[ndeka28]

Hi @tylerjroach ,
Thanks a lot for getting back to me. Yes I have confirmed that I made the same configuration change as iOS and having the same problem in Android, user getting logged out. Here is the log , I can see on launch, Credential stored is coming as Empty.

cognito_log_on_launch.txt

I have put some debug logs inside SDK code, and the looks like Android implementation is bit different than iOS. It is about how SDK stores and retrieves the credential. SDK stores credential in as a Key-value pair , where key is calculated based on below function

amplify-android/aws-auth-cognito/src/main/java/com/amplifyframework/auth/cognito/data/AWSCognitoAuthCredentialStore.kt

Lines 82 to 93 in 5162009

	private fun generateKey(keySuffix: String): String {
	var prefix = "amplify"
	authConfiguration.userPool?.let {
	prefix += ".${it.poolId}"
	}
	authConfiguration.identityPool?.let {
	prefix += ".${it.poolId}"
	}
	return prefix.plus(".$keySuffix")
	}

In the old configuration, where we had the Credential Provider config, and user logged in, Key is calculated based on both config, which looks like amplify.eu-west-1_xxxx.eu-west-1:xxxxxx.session, user Credential is mapped to this value. But when we update the config be removing Credential provider, the key looks like amplify.eu-west-1_xxxx.session. Since the key mismatches, stored credential value cannot be retrieved.

Can you please have a look on the SDK side, based on this information.

Thanks,
Nila

[tylerjroach]

Thanks for the info. I see it now. Were going to have to take a deeper look on this on our side. Changing this behavior appears to be more complex than the Swift fix, as the identityPool is part of the credential key lookup. I'll keep you updated on the investigation.

[ndeka28]

Hi @tylerjroach , have a get a chance to resolve the above issue?

[tylerjroach]

Hi @ndeka28,

As stated earlier, Android uses the identityPool id in the key itself. If it is removed, it will not match.

When you remove the identityId, the lookup for on the key/value pair will fail, because the key will no longer have the identityId. Lets saya customer were to have changed identity pools, but kept the same user pool. Now they would have 2 keys such as

1. amplify.{userPoolId}.{identityPoolId1}.session
2. amplify.{userPoolId}.{identityPoolId2}.session

There's also a possibility that a customer has already used identityId in the past, removed it, and allowed the customer to re-authenticate.

3. amplify.{userPoolId}.session

If the identityPool is no longer used, Amplify would have to make a decision credential to use (1, 2, or 3 could all exist). This isn't really an assumption that we can make. Its possible we could resolve to a credential if only 1 of these 3 scenarios are true, but this could lead to unexpected behaviors. For any behavioral changes on Amplify's end, this may be something we would need to investigate further on a breaking change major release.

I know it would take a bit of work on your side, but you could write a migration that uses the identityId you no longer want to use, looks up those key/value pairs, and saves them back into the userPoolId only format. Our code is open source and your app has the same access levels we have in the library to read/write from the credential stores we create.