OAuth - Error handling auth response. Error: invalid_grant

[kimfucious]

This is a weird one, but I've exhausted myself trying to get to the bottom of it, so I'm asking it here, thinking it is a bug, due to the very specific behaviour.

The behaviour is similar to #3185, but different, I think.

• I've got a React web app that uses Amplify Auth for user authentication
• users can sign up and sign in with a username and password
• there is a preSignup script that will link the social users to the username/password user (if it exists).
• at present, initial user creation works.
• if a user tries to sign in with Google or Apple before the initial username/password user is created, the preSignup script will return a response, that the app acts on to inform the user to create a username/password user first.

After the initial username/password user has been created, a user can sign in using Auth.federatedSignIn({ provider: "SignInWithApple"});. It works smashingly! (even though I know it's not supported officially by Amplify yet).

However, after the initial username/password user has been created, if the user tries to log in with Google, before attempting to sign in with Apple, via Auth.federatedSignIn({ provider: "Google"});, an error is thrown when trying to do a post to https://myapp.auth.[region].amazoncognito.com/oauth2/token.

The error message is:

OAuth - Error handling auth response. Error: invalid_grant

What appears to happen is: the user is returned to the app via the user pool callbackUrl, at which point Hub receives this and says:

"Retrieving tokens from https://myapp.auth.[region].amazoncognito.com/oauth2/token"

That's when the error is thrown. And since the error is thrown, the preSignup script is never called (so says CloudWatch), and the app is stuck in the water.

I understand this error means that one of the following has occurred:

• Refresh token has been revoked.
• Authorization code has been consumed already or does not exist.

For the record, I am not calling Amplify.configure(awsconfig); twice anywhere. It's called once in index.js.

Now here's the weird part...

I can only sign in with Google after first signing in with Apple (after the initial username/password user is created, as mentioned prior).

In other words, after I create the initial username/password user, I can immediately (without ever signing in with username/password) sign in with Apple, but I can't with Google.

But after I sign in with Apple, I then can sign in with Google.

And I got no idea why 🤷

I realize this is weird and that you may need more info, so please ask for what you may need, and I'll be happy to share.

[kimfucious]

I've made an interesting discovery, which I'll share, but first a little background.

This user pool serves both a web-app and a react-native app (Expo). There are actually three user pools for : dev, staging, and prod.

This means that the callback and sign-out urls are mixed, like the below:

dev:

Callback URL(s): exp://192.168.1.116:19000/--/, https://localhost:3000/auth-callback
Sign out URL(s): exp://192.168.1.116:19000/--/, https://localhost:3000

staging:

Callback URL(s): exp://exp.host/@kimfucious/myapp-staging, https://staging.myapp.com/auth-callback
Sign out URL(s): exp://exp.host/@kimfucious/myapp-staging, https://staging.myapp.com

production:

Callback URL(s): myapp://, https://myapp.com/auth-callback
Sign out URL(s): myapp://, https://myapp.com

My reporting of this issue is based on the web-app's behavior in dev, at the moment.

I do use a manual configuration of Amplify, so that the web app and react-native app only use the callback and sign-out urls that are pertinent to them, so in the web-app, this would look like this as part of a larger config (based on aws-exports.js):

...
oauth: {
domain: "myapp-dev.auth.[region].amazoncognito.com",
scope: [
    "phone",
    "email",
    "openid",
    "profile",
    "aws.cognito.signin.user.admin"
],
redirectSignIn: "https://localhost:3000/auth-callback",
redirectSignOut: "https://localhost:3000",
responseType: "code"
},
...

My discovery is that removing the exp urls from the dev user pool (via the UI or via Amplify CLI), like the below, will fix the strange behavior that I mentioned prior:

dev:

Callback URL(s): https://localhost:3000/auth-callback
Sign out URL(s): https://localhost:3000

However; doing the above, unfortunately, breaks the RN app auth process.

As an added quirk, the user pool currently (automatically) sorts the Sign in and sign out URLs, as I've raised here, so I can't simply re-order the URLs to get this to work.

If this is not a bug, I'd sure like to know what I'm doing wrong here! 🌮

[tvergho]

I'm also getting a similar issue – creating an initial user through Facebook works fine, but using the preSignUp script to link an existing user with a social account results in the OAuth - Error handling auth response. Error: invalid_grant error. Would like to hear about any solutions to this!

[Jun711]

@kimfucious
I got this same error through different steps. Refer to the above linked issue.

1. login with google (this gmail doesn't exist in user pool yet)
2. delete google account
3. sign up cognito using the same gmail
4. login with google (link account)

[rahulje9]

can you please share the preSignup script as I want to merge the social login with the email and password login.

[kimfucious]

Hi @rahulje9

My pre-signup script is somewhat of a mess and probably would confuse you more than help.

Checkout the answer here. It might get you on the right path with what you're trying to do.

[sammartinez]

Hey @kimfucious, as you have found and what we recommend to solve this use case is around the pre signup scripts. We do, in the Amplify CLI, have Lambda Triggers that you are able to configure against pre-signup in order to use. Since this is what we would recommend to use, I am going to resolve this issue. Please let us know if there is anymore questions you have in regards to this. Thanks!

[github-actions]

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.