Implement API to fetch a User's Cognito Group

[rommank]

    try {
      String result = await Amplify.Auth.fetchUserAttributes().then(
        (list) {
          return list
              .firstWhere(
                  (element) => element.userAttributeKey == 'cognito:groups')
              .value
              .toString();
        },
      );
    } on AuthException catch (e) {
      print(e.message);
    }

Is there another way to find out user's group?

[haverchuck]

@rommank Currently, I do not believe Cognito exposes a non-Admin API to get a user's groups. However, they are included in the idtoken. I am marking this as a feature request so that we can possible implement a solution on our end , but in the interim you can get these values with a jwt library such as jwt_decode. (This isn't necessarily an endorsement of that library over others- it's simply for the purposes of example.)

import 'package:jwt_decode/jwt_decode.dart';
...
void _fetchSession() async {
    try {
      CognitoAuthSession res = await Amplify.Auth.fetchAuthSession(
          options: CognitoSessionOptions(getAWSCredentials: true));
      // Grab the idtoken from the response
      String token = res.userPoolTokens.idToken;
      // Parse the JWT
      Map<String, dynamic> payload = Jwt.parseJwt(token);
      // Access the groups
      List groups = payload['cognito:groups'];
      print(groups);
    } on AmplifyException catch (e) {;
      print(e);
    }
 }

[rhamnett]

My raw jwt token does not contain the group:

{sub: a027998a-718d-46da-80a0-xxxxxxxxxxx, aud: 45qhp1cnsmgd3xxxxxxxxx, email_verified: true, event_id: 5e17a1a9-24b6-4cb1-b04b-765b5fea99fd, token_use: id, auth_time: 1614853289, iss: https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_OWblHxxxx, cognito:username: a027998a-718d-46da-80a0-cb5xxxxxxx, exp: 1614856889, iat: 1614853289, email: xxx@xxxxxxx.com}

[rommank]

My raw jwt token does not contain the group:

{sub: a027998a-718d-46da-80a0-xxxxxxxxxxx, aud: 45qhp1cnsmgd3xxxxxxxxx, email_verified: true, event_id: 5e17a1a9-24b6-4cb1-b04b-765b5fea99fd, token_use: id, auth_time: 1614853289, iss: https://cognito-idp.eu-west-1.amazonaws.com/eu-west-1_OWblHxxxx, cognito:username: a027998a-718d-46da-80a0-cb5xxxxxxx, exp: 1614856889, iat: 1614853289, email: xxx@xxxxxxx.com}

Have you assigned a Cognito Group to your user? Because, if not, your payload is not going to have "cognito:groups".

[rommank]

@rommank Currently, I do not believe Cognito exposes a non-Admin API to get a user's groups. However, they are included in the idtoken. I am marking this as a feature request so that we can possible implement a solution on our end , but in the interim you can get these values with a jwt library such as jwt_decode. (This isn't necessarily an endorsement of that library over others- it's simply for the purposes of example.)

import 'package:jwt_decode/jwt_decode.dart';
...
void _fetchSession() async {
    try {
      CognitoAuthSession res = await Amplify.Auth.fetchAuthSession(
          options: CognitoSessionOptions(getAWSCredentials: true));
      // Grab the idtoken from the response
      String token = res.userPoolTokens.idToken;
      // Parse the JWT
      Map<String, dynamic> payload = Jwt.parseJwt(token);
      // Access the groups
      List groups = payload['cognito:groups'];
      print(groups);
    } on AmplifyException catch (e) {;
      print(e);
    }
 }

Thanks for the solution!

[rhamnett]

Seem I rebuilt the environment at some point and was without a group :) cheers

[SalahAdDin]

@rommank Currently, I do not believe Cognito exposes a non-Admin API to get a user's groups. However, they are included in the idtoken. I am marking this as a feature request so that we can possible implement a solution on our end , but in the interim you can get these values with a jwt library such as jwt_decode. (This isn't necessarily an endorsement of that library over others- it's simply for the purposes of example.)

import 'package:jwt_decode/jwt_decode.dart';
...
void _fetchSession() async {
    try {
      CognitoAuthSession res = await Amplify.Auth.fetchAuthSession(
          options: CognitoSessionOptions(getAWSCredentials: true));
      // Grab the idtoken from the response
      String token = res.userPoolTokens.idToken;
      // Parse the JWT
      Map<String, dynamic> payload = Jwt.parseJwt(token);
      // Access the groups
      List groups = payload['cognito:groups'];
      print(groups);
    } on AmplifyException catch (e) {;
      print(e);
    }
 }

I support the new feature from the API.

@haverchuck With the new Amplify version i'm getting the next error:
A value of type 'AuthSession*' can't be assigned to a variable of type 'CognitoAuthSession'.

[Jordan-Nelson]

@SalahAdDin if you are seeing that in the following assignment

CognitoAuthSession res = await Amplify.Auth.fetchAuthSession(
  options: CognitoSessionOptions(getAWSCredentials: true));

I believe you just need to cast it to a CognitoAuthSession as fetchAuthSession returns AuthSession.

CognitoAuthSession res = await Amplify.Auth.fetchAuthSession(
  options: CognitoSessionOptions(getAWSCredentials: true)) as CognitoAuthSession;

The documentation shows this cast as well. I am not sure if this changed at some point in time. Apologies if it did.

[dnys1]

Please see this discussion for how to do this in the current stable (^0.6.0) and dev-preview (^1.0.0-0) versions. In the latest dev-preview version, this is very simple now:

final session =
    await Amplify.Auth.fetchAuthSession() as CognitoAuthSession;
final idToken = session.userPoolTokens!.idToken;
final userGroups = idToken.groups;

At the moment, we have no plans to add further APIs for retrieving the user groups.