UPDATE 2015-10-28 - Version 2.4.0 of Google login for iOS seems to have resolved this issue, idToken, and accessToken is updated as needed with new GIDAuthenticationmethods getTokensWithHandler:and refreshTokensWithHandler:. GIDSignInThe method SignInSilentlyalso updates both tokens.
I am using the AWS Mobile SDK for iOS, and I have implemented Google login as a Cognito credential provider using the AWS Cognito Sync sample code as the basis. The login (and subsequent silent login) is working correctly, and users with a subscription can access AWS resources such as DynamoDB as intended.My problem is that it user.authentication.idTokenexpires in one hour, at which point AWS calls fail with authentication errors. I can update user.authentication.accessTokenusing
[self.googleUser.authentication refreshAccessTokenWithHandler:^(NSString *accessToken, NSError *error) {...}
but it does not update idToken. I also tried to call
[[GoogleSignIn sharedInstance] signInSilently];
which gives me a valid idToken on the first call in the session, but although it succeeds, it does not update the idToken on subsequent calls during the same session.
I checked / reset the contents of the token using
https:
and
https:
I'm not sure the problem is that GIDSignIn is not updating the idToken, or that AWS should use refreshToken in order to somehow automatically update the user to the backend. In any case, I have no ideas.
The following are snippets of code. I tested using GoogleSignIn 2.2.0 and 2.3.2 and experienced the same problem.
...
@interface MySignInClass <GIDSignInDelegate>
...
-(void) signInWithGoogle
{
GIDSignIn *signIn = [GIDSignIn sharedInstance];
signIn.clientID = MY_GOOGLE_CLIENT_ID;
signIn.shouldFetchBasicProfile = YES;
signIn.scopes = [NSArray arrayWithObjects:@"https://www.googleapis.com/auth/userinfo.profile", @"openid", nil];
signIn.delegate = self;
if([signIn hasAuthInKeychain]) {
[signIn signInSilently];
} else {
[signIn signIn];
}
}
...
- (void)signIn:(GIDSignIn *)signIn
didSignInForUser:(GIDGoogleUser *)user
withError:(NSError *)error
{
if (error != nil) {
[self handleSignInError:error];
}
else {
NSString *idToken = user.authentication.idToken;
NSDictionary* logins = @{@"accounts.google.com": idToken};
self.credentialsProvider = [[AWSCognitoCredentialsProvider alloc]
initWithRegionType:MY_COGNITO_REGION_TYPE
identityId:nil
identityPoolId:MY_COGNITO_IDENTITY_POOL
logins:logins];
AWSServiceConfiguration *configuration = [[AWSServiceConfiguration alloc]
initWithRegion:MY_COGNITO_REGION
credentialsProvider:self.credentialsProvider];
AWSServiceManager.defaultServiceManager.defaultServiceConfiguration = configuration;
AWSTask* task = [self.credentialsProvider getIdentityId];
...
}
}
...
- (void)signIn:(GIDSignIn *)signIn
didDisconnectWithUser:(GIDGoogleUser *)user
withError:(NSError *)error
{
[self handleGoogleSignout];
}
...