[React Native - Auth] Sign in With Apple (SIWA) - Calling deleteUser does not clear your SIWA Account correctly.
#14208
Comments
github-actions
bot
added
pending-triage
|
Hi @ChristopherGabba the Amplify JS |
github-actions
bot
removed
the
pending-maintainer-response
HuiSF
added
Auth
|
I noticed there is an API here: https://developer.apple.com/documentation/signinwithapplerestapi/revoke_tokens , this would be kind of a pain to implement on the front end side given I don't have access to client secrets from amplify, etc. Is this something that could be handled on the backend? |
|
Reading the description of that API, I don't it does what you expected though, it's specifically for revoking Apple issued access token with providing Apple issued refresh token. Which is not related to using Amazon Cognito while using sign-in with Apple as an identity provider. |
github-actions
bot
removed
the
pending-maintainer-response
|
You are way more experienced than I am so I trust your judgement, but it seems like based off several threads that I've read that this is possible using this API from Apple Revoke Token Docs Stack Overflow Articles: I think this would be an awesome add to the Amplify API personally as it is definitely a pain to have to go back and forth between settings, but I obviously am just an end user. Would make account creation with Apple fully seamless from end to end. If you think this is not feasible (or just not possible), please feel free to just close issue! Thanks again for the great communication. Just as a side note, to complete the token revocation with all social providers, Google sign in does appear to have a similar method and similarly Facebook: link |
github-actions
bot
added
the
pending-maintainer-response
ashika112
added
pending-maintainer-response
|
I'll bring this topic to the Amazon Cognito service team and hopefully to get some insights. |
github-actions
bot
removed
the
pending-maintainer-response
|
Sorry for the misunderstanding @ChristopherGabba I think you are right about the purpose of this Apple's endpoint. I double checked with the Cognito service team, that the Cognito I will mark this issue as a feature request for further investigation. |
HuiSF
added
feature-request
github-actions
bot
removed
the
pending-maintainer-response
|
@HuiSF Just a quick update, turns out there is a very similar issue with google sign in. If you delete your account and try to log back on, you get similar errors. You have to clear the app from your google sign in account. So this "bug" is probably present across all social providers. |
github-actions
bot
added
the
pending-maintainer-response
|
Hey @ChristopherGabba what's the error you were seeing? When I was testing SIWA, even though the |
github-actions
bot
removed
the
pending-maintainer-response
|
After calling Somehow the provider is not sending all the required Cognito data for a new sign up unless they also think it's a new sign up? As referenced above in the pictures, the sign in screen is almost different altogether for SIWA when it thinks the user already exists. Here is my auth setting (maybe this can help you reproduce): import { defineAuth, secret } from "@aws-amplify/backend"
import { blockDuplicateEmails } from "../functions/blockDuplicateEmails/resource"
/**
* Define and configure your auth resource
* @see https://docs.amplify.aws/gen2/build-a-backend/auth
*/
export const auth = defineAuth({
loginWith: {
email: {
verificationEmailSubject: "Verify Your ReactApp Account",
verificationEmailBody: (createCode: any) => `Your ReactApp verification code is: ${createCode()}`,
},
phone: {
verificationMessage: (createCode) =>
`Use this code to confirm your ReactApp account: ${createCode()}`,
},
externalProviders: {
google: {
clientId: secret("GOOGLE_CLIENT_ID"),
clientSecret: secret("GOOGLE_CLIENT_SECRET"),
attributeMapping: {
email: "email",
emailVerified: "email_verified",
familyName: "family_name",
givenName: "given_name",
phoneNumber: "phone_number",
},
scopes: ["email", "openid", "profile", "phone"],
},
signInWithApple: {
clientId: secret("SIWA_CLIENT_ID"),
keyId: secret("SIWA_KEY_ID"),
privateKey: secret("SIWA_PRIVATE_KEY"),
teamId: secret("SIWA_TEAM_ID"),
attributeMapping: {
email: "email",
givenName: "firstName",
familyName: "lastName",
emailVerified: "email_verified"
},
scopes: ["email", "name"],
},
callbackUrls: ["reactapp://callback/"],
logoutUrls: ["reactapp://signout/"],
},
},
accountRecovery: "EMAIL_ONLY",
userAttributes: {
birthdate: {
mutable: true,
required: false,
},
phoneNumber: {
mutable: true,
required: false,
},
givenName: {
mutable: true,
required: false,
},
familyName: {
mutable: true,
required: false,
},
preferredUsername: {
mutable: true,
required: false,
},
profilePicture: {
mutable: true,
required: false,
},
},
triggers: {
preSignUp: blockDuplicateEmails
}
})I think a lot of this just loops back to the fact that if |
github-actions
bot
added
the
pending-maintainer-response
|
Oh sorry I missed out the original error description for some reason. The error message is library specific though when something went wrong opening the WebView for signing in, and I don't think it's related to Cognito doesn't clear the relay accounts created from the provider. @ChristopherGabba Could you not using the Also can you confirm, after you called |
github-actions
bot
removed
the
pending-maintainer-response
|
@HuiSF , to answer your second question, yes, calling As it turns out, the first time you create an account with SIWA, it always provides the first and last name and maps it correctly to Cognito. After you delete your account and re-sign up (with out clearing SIWA in the apple settings), the 
I would almost go as far to say that the amplify build process should generate an error saying that attributes must be set to not required when social providers are provided, especially if "If you are using social providers with Cognito, its necessary to set all I'd also like to add some small feedback that tripped me up in the 
Right now, the docs don't show all the attribute mappings available, so it leaves it up to the devs using amplify to kinda dig into and find out, which really isn't too necessary. 
Additionally, the attribute mapping is not type-safe either. I basically had to guess as to the proper attribute mapping (with underscores, etc.) until it worked. I feel like that could be improved upon as well by making each attribute type safe. 
All these improvements would have probably saved me several hours to a full day of experimenting. I know some of these are unrelated to the issue, but felt like I needed a good place to include them. |
github-actions
bot
added
the
pending-maintainer-response
|
@ChristopherGabba thank you for the detailed analysis. We will take your suggestions for documentation improvements as an action item. Regarding the DX / type safety improvements, We'd recommend opening a feature request against the amplify-backend repository as they'd be able to provide direct support here with the attribute mapping. |
github-actions
bot
removed
the
pending-maintainer-response
Before opening, please confirm:
JavaScript Framework
React Native
Amplify APIs
Authentication
Amplify Version
v6
Amplify Categories
auth
Backend
Amplify Gen 2
Environment information
Describe the bug
`
Expected behavior
Let's say I have a very simple app:
1 Sign in with apple button on the auth screens
2. A screen with a button that lets me delete the user using
deleteUseron the main screensThe very first time I open my app, I tap the
Sign in With Applebutton, everything works and something like this pops up:I correctly authenticate. I then say "eh I don't want an account" so I tap the
Delete Accountbutton that just callsdeleteUserfrom amplify.It correctly deletes my account from Cognito and sends me back to the Homescreen.
I then tap
Sign in with Appleagain but this time, Apple still thinks I have an account with the app and it looks like this now instead:(sorry I can't take a screenshot, it won't let me)
I try to hit
Sign inand it fails to create an account.I have to go to my iPhone settings -> Account -> Sign in With Apple -> Remove my App manually.
Once this is done, it then Signs me up for an account correctly again.
Ideally this would be handled for me when I call
deleteUser, or there would be a prop like so:I understand that this is a pretty unique edge case but it does make it very annoying to keep testing
Sign in With Applebecause I have to keep going back and forth to settings.Reproduction steps
See above.
Code Snippet
Log output
aws-exports.js
No response
Manual configuration
{ "auth": { "user_pool_id": "XXXX", "aws_region": "us-east-1", "user_pool_client_id": "XXXX", "identity_pool_id": "XXXX", "mfa_methods": [], "standard_required_attributes": [ "email", "given_name", "family_name" ], "username_attributes": [ "email", "phone_number" ], "user_verification_types": [ "email", "phone_number" ], "mfa_configuration": "NONE", "password_policy": { "min_length": 8, "require_lowercase": true, "require_numbers": true, "require_symbols": true, "require_uppercase": true }, "oauth": { "identity_providers": [ "GOOGLE", "SIGN_IN_WITH_APPLE" ], "redirect_sign_in_uri": [ "reactapp://callback/" ], "redirect_sign_out_uri": [ "reactapp://signout/" ], "response_type": "code", "scopes": [ "phone", "email", "openid", "profile", "aws.cognito.signin.user.admin" ], "domain": "XXXX" }, "unauthenticated_identities_enabled": true }, "version": "1.1" }Additional configuration
No response
Mobile Device
iPhone12
Mobile Operating System
iOS18
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response
The text was updated successfully, but these errors were encountered: