84

I'm using the JavaScript SDK for AWS Cognito, and there are a couple of custom attributes that I just can't seem to save to and can't see why.

The problem attributes are mutable string fields as follows:

custom: role
custom: recruitingrole
custom: title

Other custom fields in the same request seem to update OK. Specifically, these ones seem to work:

custom:division
custom:linkedin
custom:location
custom:bio

When I submit via the SDK, this is returned:

{"__type":"NotAuthorizedException","message":"A client attempted to write unauthorized attribute"}

Here is the data that is sent, as show in the Chrome developer console network output:

{
    "AccessToken": "",
    "UserAttributes": [{
        "Name": "name",
        "Value": "Steve Austin"
    }, {
        "Name": "custom:company",
        "Value": "OSI"
    }, {
        "Name": "custom:division",
        "Value": "Bionics"
    }, {
        "Name": "custom:recruitingrole",
        "Value": "other"
    }, {
        "Name": "custom:linkedin",
        "Value": "http://www.linkedin.com"
    }, {
        "Name": "custom:location",
        "Value": "Mexico City, Mexico City, Mexico"
    }, {
        "Name": "custom:bio",
        "Value": "A man barely alive."
    }]
}

Can anyone suggest why I can't save to these attributes?

thanks

10 Answers 10

174

Of course the answer became clear the moment I finished posting on StackOverflow.

The problem was that I had not set permissions for these attributes in the app associated with the user pool. The documentation should make this requirement clear where it discusses custom attributes.

enter image description here

9
  • 3
    Glad to see you found the answer to your question. The doc for this feature is here: docs.aws.amazon.com/cognito/latest/developerguide/… I can see that it calls out the permissions/scope on attributes, and the error which you were receiving. If there's any specific edit you think should be made, or if there's something that could be added to make it more helpful/easier to read I'd encourage you to submit feedback using the button on the bottom right of the page. :) Commented May 17, 2017 at 10:14
  • @robDevereux I did as you suggested but along the way got various warnings Your connection is not secure The owner of docs-feedback.aws.amazon.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. Learn more… Report errors like this to help Mozilla identify and block malicious sites Commented May 17, 2017 at 10:39
  • 23
    Above mentioned documentation still does not make it clear where you can set attribute permissions. I have found it to be in the General settings -> App clients -> Show details -> Set attribute read and write permissions link
    – mvandillen
    Commented Dec 15, 2017 at 14:12
  • 12
    I am unclear how these settings are supposed to be set. I have every box checked and it still doesn't work.
    – eignhpants
    Commented Apr 28, 2018 at 14:16
  • 1
    Would it be possible to get a more detailed error message. Like, which attribute is causing the issue? Commented Jul 8, 2019 at 23:53
90

Just highlighting the answer from @mvandillen:

General settings -> App clients -> Show details -> Set attribute read and write permissions link

1
  • This worked as charm!! thanks Commented Oct 31, 2021 at 14:38
24

For anyone that stumbles upon this question:

Like the others suggested, you should enable the writable attributes. But if that doesn't work, make sure you use the custom: prefix:

await Auth.signUp({
      username: email,
      password: password,
      attributes: {
        'custom:firstName': firstName,
        'custom:lastName': lastName,
        'custom:countryCode': countryCode
      }
    })
3
  • lol, when I use a colon I get a new error Attributes did not conform to the schema: name.formatted: The attribute name.formatted is required, which leads me to think I have to use custom.xyz but then I'm greeted with the OP's error...
    – Adrian
    Commented Jun 20 at 23:33
  • Oh, it appears I made the name attribute required at signup and there seems to be no obvious way to look at which attributes are required in the UI. The above error is what is thrown if you leave a required attribute out. I'm assuming the name will be attributename.formatted depending on the attribute you left out
    – Adrian
    Commented Jun 20 at 23:44
  • Seems like the settings are in UserPool -> Sign-Up Experience -> Required Attributes
    – Adrian
    Commented Jun 20 at 23:47
7

To fix this error, you need to make sure that your app has permission to write the custom attribute that you're trying to write. You can do this by checking the permissions for the attribute and the app client in the Cognito user pool console.

Here are the steps to fix the error:

  1. Go to the Cognito user pool console.
  2. Click on the User Pools tab.
  3. Select the user pool that you're having problems with.
  4. Click on the App integration tab.
  5. Click on the App clients section.
  6. Select the app client that you're using.
  7. Click on the Attribute read and write permissions section.
  8. Make sure that the checkbox next to the attribute that you're trying to write is checked.
  9. If the checkbox is not checked, then check it and save your changes.

Once you've done this, you should be able to write the custom attribute without getting the error.

1
  • That's one hidden setting to check on the app client settings. Thanks it fixed my issue. Commented Jul 13, 2023 at 3:20
2

In my case the issue was in accessing variable with incorrect name. To sum up my steps were following.

  1. Add attribute: General settings -> Attributes -> Add custom attribute link

  2. Ensure you set read/write permissions: General settings -> App clients -> Show details -> Set attributes permissions link

  3. Do not forget to access you variable with correct name. For example if your variable named 'foo' you should get it as 'custom:foo' like below.

enter image description here

1

I would just like to add to the list regarding Android and Amplify's Auth lib. Along with enabling custom roles as specified above via AWS Console (General settings -> App clients -> Show details -> Set attribute read and write permissions link) you need to specify that the custom role under AuthUserAttributeKey.custom() has the string custom: prepended to your custom field. My assumption was that this would be excluded given the function call name. A little misleading but I hope this helps someone else out there.

TLDR;

Changed this:

AuthUserAttributeKey.custom("role");

to:

AuthUserAttributeKey.custom("custom:role");
1

2024 Update:

You can find the attribute read and write permissions for your app clients in Amazon Cognito by following these steps:

Navigate to Amazon Cognito: Log into your AWS Management Console and go to the Amazon Cognito service.

Select Your User Pool: In the Cognito dashboard, you'll see a list of User Pools. Select the User Pool associated with your app.

App Integration: Once you're in your User Pool, look for the 'App integration' section in the left-hand menu.

App Client List: Inside the 'App Integration' section, click on 'App client list'. This will show you all the app clients that have been created within the selected User Pool.

Select Your App Client: Find the app client that you're interested in. This is typically identified by the [App name] you've given it.

Attribute Read and Write Permissions: Click on the specific app client. You'll be taken to a page with various settings. Look for the section named 'Attribute read and write permissions'. Here, you will find the list of attributes and their respective read and write permissions.

0

Using Amazon.Extensions.CognitoAuthentication in ASP.NET Core, you have to add:

var user = _pool.GetUser(model.Email)
user.Attributes.Add("name", model.Name);

Here name is the custom attribute

0

My case is a bit different. I am using Amplify angular component and I don't have any custom attributes (standard email login type).

It turns out that the key of the sign-up fields is case-sensitive. For the uppercase 'Email' key, I will see the error. Below is the sign-up configurations

emailSignUpConfig = {
        header: 'Sign up header',
        hideAllDefaults: true,
        defaultCountryCode: '1',
        signUpFields: [
            {
                label: 'Email',
                key: 'email', //the email should be in lower case
                required: true,
                displayOrder: 1,
                type: 'string',
            },
            {
                label: 'Password',
                key: 'password',
                required: true,
                displayOrder: 2,
                type: 'password',
            },
        ],
    };
0

After enabling writeable attributes, this is what works for me

    const user = {
     username:this.username,
     password:this.password,     
      attributes:{
      email:this.email,
      'custom:field1': this.field1,
      'custom:field2': this.field2,
      'custom:field3': this.field3
     }
   }


             OR



   const user = {
     username:this.username,
     password:this.password,
     email:this.email,
      attributes:{
      'custom:field1': this.field1,
      'custom:field2': this.field2,
      'custom:field3': this.field3
     }
   }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.