Cognito - On signin it give this error: Error executing "AdminInitiateAuth" on "https://cognito-idp.eu-west-1.amazonaws.com";

[marioruimelo]

Hi,

I'm getting the following error, when i try to authenticate with AdminInitiateAuth:

Error executing "AdminInitiateAuth" on "https://cognito-idp.eu-west-1.amazonaws.com"; AWS HTTP error: Client error: `POST https://cognito-idp.eu-west-1.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"UnrecognizedClientException","message":"The security token included in the request is invalid."}

With InitiateAuth I have no problem, the login is done and I receive the Aws\Result Object.

if I execute the following command in AWS CLI the login is also OK:

aws cognito-idp admin-initiate-auth --user-pool-id <USER_POOL_ID> --client-id <CLIENT_ID> --auth-flow ADMIN_NO_SRP_AUTH --auth-parameters USERNAME=<USERNAME>,PASSWORD=<PASSWORD>

This is the code:

	$auth_result = $this->_cognito->adminInitiateAuth([
		AuthFlow => ADMIN_USER_PASSWORD_AUTH,
		ClientId => $_ENV[COGNITO_APP_CLIENT_ID],
		UserPoolId => $_ENV[COGNITO_USER_POOL_ID],
		AuthParameters => [
			USERNAME => $username,
			PASSWORD => $password,
		]
	]);

Can anybody give me a clue?

Thanks ;)

[yenfryherrerafeliz]

Hi @marioruimelo, sorry to hear about your issues. This error tends to happen when using temporary credentials and the session token is either empty or invalid. I see that it is working fine in CLI, but could you please tell me which type of credential provider are you using for this request?

Thanks!

[marioruimelo]

Hi,

i have the credentials in a .env file:

`AWS_REGION="eu-west-1"
AWS_ACCESS_KEY_ID="000000000000000000"
AWS_SECRET_ACCESS_KEY="00000000000000000000000000000000"
AWS_VERSION=latest

COGNITO_USER_POOL_ID="eu-west-1_0000000"
COGNITO_APP_CLIENT_ID="0000000000000000000"

COGNITO_USER="00000000000"
COGNITO_PASSWORD="000000000000000000"`

[yenfryherrerafeliz]

@marioruimelo, so I guess then that you read those values at runtime and populate the credential parameter, of the client object, with those values. Can you please confirm if those credentials are not temporary?, and could you please also show how you create the instance of the client. It would be help full if you provide a complete reproducible scenario so we can better assist you. For example, could you please provide a sample code where we can see how you pass those credentials, to the client, etc.

Thanks!

[marioruimelo]

Hi, @yenfryherrerafeliz,

The credentials are temporary.

I get these credentials executing the command "aws sso get-role-credentials......" and I put them in the .env file.
I already tried with the credentials available in browser -> Command line or programmatic access and the result is the same.

Code excerpt:

$cognito = new App\Cognito\Cognito;


echo "[AccessToken] => ".$cognito->login($_ENV['COGNITO_USER'],$_ENV['COGNITO_PASSWORD']);

-----------------------

/**
     * Initialize the Cognito Identity Provider Client
     */
    private function _initialize()
    {
        $this->_cognito = new CognitoIdentityProviderClient([
            'region' => $_ENV['AWS_REGION'],
            'version' => $_ENV['AWS_VERSION'],
            'credentials' => array(
                'key' => $_ENV['AWS_ACCESS_KEY_ID'],
                'secret'  => $_ENV['AWS_SECRET_ACCESS_KEY'],
            )
        ]);
    }


-----------------------

public function login($username, $password)
    {
        $this->_authenticate($username, $password);
        if (is_array($this->_auth_result)) {
            return $this->_auth_result['AccessToken'];
        }
        return false;
    }
	

-----------------------

private function _authenticate($username, $password)
    {
        try {
            if (isset($this->_cognito)) {

                $auth_result = $this->_cognito->adminInitiateAuth([
                    'AuthFlow' => 'ADMIN_USER_PASSWORD_AUTH',
                    'ClientId' => $_ENV['COGNITO_APP_CLIENT_ID'],
                    'UserPoolId' => $_ENV['COGNITO_USER_POOL_ID'],
                    'AuthParameters' => [
                        'USERNAME' => $username,
                        'PASSWORD' => $password,
                    ]
                ]);


                //OK!!!!! This works!!!!
                // $auth_result = $this->_cognito->initiateAuth([
                //     'AuthFlow' => 'USER_PASSWORD_AUTH',
                //     'ClientId' => $_ENV['COGNITO_APP_CLIENT_ID'],
                //     'AuthParameters' => [
                //                 'USERNAME' => $username,
                //                 'PASSWORD' => $password,
                //     ]
                // ]);

                print_r($auth_result);

                if ($auth_result->get('AuthenticationResult')) {
                    $this->_auth_result = $auth_result->get('AuthenticationResult');
                }

            }
        } catch (\Exception $e) {
            echo "\r\n ###################################### \r\n";
            print_r($e->getMessage());
            return $e->getMessage();
        }
    }

---

[yenfryherrerafeliz]

@marioruimelo, thanks for this information. If credentials are temporary then, you need to provide the token parameter to the credential object.
Example:

 * Initialize the Cognito Identity Provider Client
     */
    private function _initialize()
    {
        $this->_cognito = new CognitoIdentityProviderClient([
            'region' => $_ENV['AWS_REGION'],
            'version' => $_ENV['AWS_VERSION'],
            'credentials' => array(
                'key' => $_ENV['AWS_ACCESS_KEY_ID'],
                'secret'  => $_ENV['AWS_SECRET_ACCESS_KEY'],
                'token' => "YOUR_TOKEN"
            )
        ]);
    }

Please make sure you replace the YOUR_TOKEN with the correct token value. You probably got that value when getting the temporary credentials.

Please let me know if that helps!

Thanks!

[marioruimelo]

Hi @yenfryherrerafeliz ,

Thank you very much!!!!
It works!!!!

Yesterday I've read this, but I didn't understood how I could do it...

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.