https://www.ory.com/ logo
Join Slack
Powered by
Hi I am trying to connect `AWS Cognito` with `ORY ...
# ory-network
g
Hi I am trying to connect 
AWS Cognito
with 
ORY Generic Social Sign In.
Created App Client in Cognito and added its 
client id
and 
client secret
in Ory. Also added the Ory provided 
redirect URI
to Cognito. But now when I try to Sign in with my Cognito social sign in through Ory it gives following error
Copy code
{
  "id": "8713520f-0e08-4fb6-ae61-b24963715ad3",
  "error": {
    "code": 500,
    "message": "An internal server error occurred, please contact the system administrator",
    "reason": "Unable to initialize OpenID Connect Provider: 400 Bad Request: {\"code\":\"BadRequest\",\"message\":\"The server did not understand the operation that was requested.\",\"type\":\"client\"}",
    "status": "Internal Server Error"
  },
  "created_at": "2023-04-24T13:57:40.439905Z",
  "updated_at": "2023-04-24T13:57:40.439905Z"
}
I will be grateful If anyone can help me out here or If anyone has integrated AWS Cognito with Ory Generic Social Sign do let me know. Thanks
h
Hey there! Great to see you try the product. I’ll rake a look in around 15 minutes
g
Thanks a lot
h
Can you show me your configuration? You can use 
ory get identity-config <project-id> --format yaml
g
Sure currently afk give me 30 - 40 minutes
running it now, I was using Ory console now installing the ory cli
Copy code
cookies:
  domain: <http://intelligent-pascal-co29t4iy7i.projects.oryapis.com|intelligent-pascal-co29t4iy7i.projects.oryapis.com>
  path: /
  same_site: Lax
courier:
  smtp:
    from_name: Zohaib Arshad's Project via Ory
  templates:
    recovery:
      invalid:
        email:
          body: {}
      valid:
        email:
          body: {}
    recovery_code:
      invalid:
        email:
          body: {}
      valid:
        email:
          body: {}
    verification:
      invalid:
        email:
          body: {}
      valid:
        email:
          body: {}
    verification_code:
      invalid:
        email:
          body: {}
      valid:
        email:
          body: {}
feature_flags:
  cacheable_sessions: false
identity:
  default_schema_id: <preset://email>
  schemas:
  - id: <preset://email>
    url: <base64://ewogICIkaWQiOiAiaHR0cHM6Ly9zY2hlbWFzLm9yeS5zaC9wcmVzZXRzL2tyYXR>vcy9pZGVudGl0eS5lbWFpbC5zY2hlbWEuanNvbiIsCiAgIiRzY2hlbWEiOiAiaHR0cDovL2pzb24tc2NoZW1hLm9yZy9kcmFmdC0wNy9zY2hlbWEjIiwKICAidGl0bGUiOiAiUGVyc29uIiwKICAidHlwZSI6ICJvYmplY3QiLAogICJwcm9wZXJ0aWVzIjogewogICAgInRyYWl0cyI6IHsKICAgICAgInR5cGUiOiAib2JqZWN0IiwKICAgICAgInByb3BlcnRpZXMiOiB7CiAgICAgICAgImVtYWlsIjogewogICAgICAgICAgInR5cGUiOiAic3RyaW5nIiwKICAgICAgICAgICJmb3JtYXQiOiAiZW1haWwiLAogICAgICAgICAgInRpdGxlIjogIkUtTWFpbCIsCiAgICAgICAgICAib3J5LnNoL2tyYXRvcyI6IHsKICAgICAgICAgICAgImNyZWRlbnRpYWxzIjogewogICAgICAgICAgICAgICJwYXNzd29yZCI6IHsKICAgICAgICAgICAgICAgICJpZGVudGlmaWVyIjogdHJ1ZQogICAgICAgICAgICAgIH0sCiAgICAgICAgICAgICAgIndlYmF1dGhuIjogewogICAgICAgICAgICAgICAgImlkZW50aWZpZXIiOiB0cnVlCiAgICAgICAgICAgICAgfSwKICAgICAgICAgICAgICAidG90cCI6IHsKICAgICAgICAgICAgICAgICJhY2NvdW50X25hbWUiOiB0cnVlCiAgICAgICAgICAgICAgfQogICAgICAgICAgICB9LAogICAgICAgICAgICAicmVjb3ZlcnkiOiB7CiAgICAgICAgICAgICAgInZpYSI6ICJlbWFpbCIKICAgICAgICAgICAgfSwKICAgICAgICAgICAgInZlcmlmaWNhdGlvbiI6IHsKICAgICAgICAgICAgICAidmlhIjogImVtYWlsIgogICAgICAgICAgICB9CiAgICAgICAgICB9LAogICAgICAgICAgIm1heExlbmd0aCI6IDMyMAogICAgICAgIH0KICAgICAgfSwKICAgICAgInJlcXVpcmVkIjogWwogICAgICAgICJlbWFpbCIKICAgICAgXSwKICAgICAgImFkZGl0aW9uYWxQcm9wZXJ0aWVzIjogZmFsc2UKICAgIH0KICB9Cn0K
oauth2_provider: {}
selfservice:
  allowed_return_urls: []
  default_browser_return_url: /ui/welcome
  flows:
    error:
      ui_url: /ui/error
    login:
      after:
        hooks: []
        oidc:
          hooks: []
        password:
          hooks: []
        webauthn:
          hooks: []
      before:
        hooks: []
      ui_url: /ui/login
    logout:
      after: {}
    recovery:
      after:
        hooks: []
      before:
        hooks: []
      enabled: true
      notify_unknown_recipients: false
      ui_url: /ui/recovery
      use: code
    registration:
      after:
        hooks: []
        oidc:
          hooks:
          - hook: session
        password:
          hooks:
          - hook: session
        webauthn:
          hooks:
          - hook: session
      before:
        hooks: []
      ui_url: /ui/registration
    settings:
      after:
        hooks: []
        password:
          hooks: []
        profile:
          hooks: []
      before:
        hooks: []
      privileged_session_max_age: 15m0s
      required_aal: highest_available
      ui_url: /ui/settings
    verification:
      after:
        hooks: []
      before:
        hooks: []
      enabled: true
      notify_unknown_recipients: false
      ui_url: /ui/verification
      use: code
  methods:
    code:
      config: {}
    link:
      config:
        base_url: ""
      enabled: true
    lookup_secret: {}
    oidc:
      config:
        providers:
        - client_id: 31477fjj33hincpned9o76qn61
          client_secret: [Our Client Secret Do let know if you need it]
          id: SB0UOzyvatKijjVe
          issuer_url: <https://cognito-idp.us-west-2.amazonaws.com>
          label: dashboard-dev-cognito
          mapper_url: <https://storage.googleapis.com/bac-gcs-production/83529b82873f5d16ea387e640dfcc85aaeb82551de52d4749bdf8f08c1052424a21db5dfc85d488bfb83be20ed08c10645e88b8e3bb2a92011240161ffcca175.jsonnet>
          provider: generic
          scope:
          - email
      enabled: true
    password:
      config: {}
    profile: {}
    totp:
      config:
        issuer: Zohaib Arshad's Project
    webauthn:
      config:
        passwordless: false
        rp:
          display_name: Zohaib Arshad's Project
          id: <http://intelligent-pascal-co29t4iy7i.projects.oryapis.com|intelligent-pascal-co29t4iy7i.projects.oryapis.com>
          origin: <https://intelligent-pascal-co29t4iy7i.projects.oryapis.com>
serve:
  admin:
    base_url: <https://intelligent-pascal-co29t4iy7i.projects.oryapis.com/>
    request_log:
      disable_for_health: true
  public:
    base_url: <https://intelligent-pascal-co29t4iy7i.projects.oryapis.com/>
    cors:
      enabled: false
    request_log:
      disable_for_health: true
session:
  cookie:
    domain: <http://intelligent-pascal-co29t4iy7i.projects.oryapis.com|intelligent-pascal-co29t4iy7i.projects.oryapis.com>
    name: ory_session_intelligentpascalco29t4iy7i
    path: /
    same_site: Lax
  lifespan: 72h0m0s
  whoami:
    required_aal: highest_available
Here is the project configurations
NOTE: I was able to fix the above error. The issue was Issuer Url. For cognito we also need to add the region and user pool id at the end of Cognito Issuer Url
h
Ah, perfect, glad you were able to fix it!
g
Yup, Now looking at next step. Do you see any other issues in the project configuration?
h
Not really - do you experience more problems?
g
This happens once I sign in using my cognito hosted UI and it redirects back to ory Redirect URI. I have also tried using it in Incognito
h
can you try again from the start? maybe something got confused with the errors
g
Yes thinking same, Will let you know Thanks
7 Views
Open in Slack
PreviousNext
Powered by