3

I have an Android project and i am trying to authenticate with AWS Cognito with Google Plus. I have set up Facebook authentication and that is working, but when i login with Google Plus i get a 400 : Unauthorized error

At the moment i have to set my app to 'Enable access to unauthenticated identities' so that Google Plus users can use it without getting an unauthorised exception.

My token coming back from logging in to Google Plus is fine, it also gets the users Profile and details, so i think it has something to do with IAM and maybe the 'Google Client ID' in the 'Edit identity pool' section in the AWS dashboard.

At the moment i have my OAuth 2.0 Service account Client ID from my Google Developers Console as the 'Google Client ID' in the 'Edit identity pool' section in the AWS dashboard

Someone please help :)

2 Answers 2

5

Due to the way Google handles client IDs, we actually recommend that customers use our generic OpenId Connect support when configuring their identity pool for Google login.

  1. Go to AWS IAM Console's identity provider section.
  2. Create an OpenId Connect Identity Provider with provider URL as https://accounts.google.com and Audience as one of the client Ids.
  3. Follow the steps to create identity provider and later you will have an option to add additional client ids.
  4. Go to Amazon Cognito Console.
  5. Create or edit an identity pool and add the OpenID connect identity provider to the pool (it should appear in the OpenId Connect providers).

If at a later date you add iOS or web support, create your new client IDs in the Google console and add them to your OpenId Connect provider in the IAM console.

4
  • Hi Bob, thanks for your time! I'm still a little bit confused. Does this look correct in my IAM Roles for my Authenticated users with Facebook and Google Plus? s29.postimg.org/cr6mb3b9j/Capture.png s14.postimg.org/9bthibem9/Capture2.png
    – Nickmccomb
    Jul 23, 2015 at 2:35
  • @Nickmccomb You don't need to modify the roles. You need to create a an OpenId Connect provider.
    – Bob Kinney
    Jul 23, 2015 at 15:37
  • Hi Bob, It's still not working for me, i'm unsure of why it's not working. What are the additional client IDs in step 3? Is this the Service ID the one in my Google Developers Console - My App - Credentials - oAuth Service Account? What would i be missing? I get tokens back from Google but Cognito gives me an authentication error
    – Nickmccomb
    Jul 26, 2015 at 15:35
  • @Nickmccomb The additional client ids would be all the client ids you see in the Google console. If you only have the Android and server applications, then only these 2. Are you sure you are actually sending an ID token? Please update your question with your code for getting the Google token if you're still having problems.
    – Bob Kinney
    Jul 27, 2015 at 4:50
1

After some days I did! My Cognito account is finally talking with Google :) My big problem was the client ID, there two of them:

  1. In the Google console we have the small client ID: XXXXXXXXXXXX.apps.googleusercontent.com
  2. In the JSON file, that you can download at Google console we have the big client ID: client_id : XXXXXXXXXXXX-XXruakXlXXjeXqjXXtvXXXXXXXXXfjn.apps.googleusercontent.com

So, I put the small at Cognito console, in Google+ Client ID

The big one I put at my code:

String token = GoogleAuthUtil.getToken(appActivity, accounts[0].name,
"audience:server:client_id:XXXXXXXXXXXX-XXruakXlXXjeXqjXXtvXXXXXXXXXfjn.apps.googleusercontent.com");

Another thing that I changed the code at Helper class, that code used to do login at google. the Google's class helper came to login at Games, so I changed to login in Plus too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.