showSignIn() POP-UP even though AWSMobileClient.default.isSignedIn = true

[Nicolaidam]

Describe the bug
A clear and concise description of what the bug is.
I'm using Appsync Graphql API with Cognito Userpool and showSignIn() method for login with Facebook. The user gets in to Userpool as expected and from here I can read/write to Graphql API. After closing the app and opening it again the user is still logged in as expected, however I get a Facebook-Login POP UP ".. wants to use.." even though I'm already logged in. (AWSMobileClient.default.isSignedIn = true) The problem only occurs with showSignIn() method using Facebook, it works as it should with the Cognito method signIn(), also after restarting the app and trying to make a mutation after that.

To Reproduce
Steps to reproduce the behavior:

1. Set up Appsync Graphql and Cognito Userpool using Amplify

2. Log in with showSignIn() Facebook login to get user into Userpool
3. Close application.
4. Open app again. The user i still logged in as expected.
5. Make mutation request to Appsync API.. The pop-up will appear even though the user is still logged in. (AWSMobileClient.default.isSignedIn = true & AWSMobileClient.default.Identityid is valid)

Which AWS service(s) are affected?
Amplify
Cognito
Appsync

Expected behavior
A clear and concise description of what you expected to happen.
I would expect that I can read/write with Appsync Graphql API when AWSMobileClient.default.isSignedIn = trueWITHOUT getting "..wants to use.."-POP-UP, also after closing the app and opening it again, since I'm suing Userpool as authentication. Therefore it is expected there is no POP-UP when communicating with Graphql API as long as I'm already logged in.

Screenshots
If applicable, add screenshots to help explain your problem.

I've made a video showing the problem.
0.13: I login with Facebook. Using showSignIn method.
0.13 - 0.38: I show how I print logged in status out in the terminal using a button "Print user info" After logging signedIn = true.
0.38 - 0.44: I show that I write to the AppSync GraphQL API using the "Opret barn"-button. (I'll show this method later)
0.44 - 0.59: I restart the app and show signedIn = true.
0.59 - 1.23: I show that I'm NOT able to write to the AppSync GraphQL API using the "Opret barn"-button without clicking the pop up.
1.23 - 1.47: I show the code getting executed after clicking "opret barn" button. (Writing to database)
1.58 - 2.22: I show initialization of AppSync GraphQL API in AppDelegate
2.22 - 2.38: I show how I go to main page if the user is already logged in. Else it should go to login screen.

LINK: https://drive.google.com/file/d/1HR6iba--yFdOffml6_TRCmLmBBEQ2BvY/view?usp=sharing

Environment(please complete the following information):

• Xcode 11.3.1
• Dependency Manager: Cocoapods
  pod 'AWSMobileClient', '> 2.12.0'
  pod 'AWSAppSync', '> 2.15.0'
• Swift Version : [e.g. 5.0]

Device Information (please complete the following information):

• Device: iPhone 11, Real Device
• iOS Version: iOS 13.3.1

Additional context
I have used this Blog-post as guide for my project:
https://amplify-ios-workshop.go-aws.com/

[Nicolaidam]

Hi AWS iOS team,
There is now gone 13 days and I've still not been able to solve it. Can you please investigate the problem?

[phani-srikar]

Hi @Nicolaidam. Thank you for reporting this issue. That video was very useful to replicate the exact setting. Thanks for that.
Here is a video of how I reproduced this issue in my sample app.
video

Brief summary:
When a user signs in using hosted UI (I confirmed this problem exists both for Facebook and Google Sign-Ins), specifying custom scopes through HostedUIOptions and restarts the app, he/she is asked to sign-in again to fetch aws tokens (This is not tied to appsync, it is a MobileClient issue).

I need little more information from you. Can you check the OAuth scopes in awsconfiguration.json file and also in the HostedUIOptions that you set in showSignIn function and see if they match?

[Nicolaidam]

Hi @phani-srikar
Thank you for the response. Actually the scopes from awsconfiguration.json and in showSignIn didn't match. I've changed them both to "email", "openid" and it seems like it fixed the problem for me..
How was your scope settings in the replicated app with pop up issue?

[phani-srikar]

Hi @Nicolaidam
I am glad you did that! I was going to ask you to do the same thing. I had custom scopes specified using HostedUIOptions too which were different from the ones in awsconfiguration.
Issue:
The HostedUIOptions are a way to specify overrides to the scopes set from awsconfiguration.
In order to persist across sessions, they are stored in keychain store. This current issue might be related to these custom scopes (might be other hostedUIOptions too) and their persistence across sessions. We are looking into this and will resolve it soon.

[Nicolaidam]

Okay thanks. Can you please explain what the different scopes do? Are they only related to the UI-login? As standard i had: "phone", "email", "openid", "profile", "aws.cognito.signin.user.admin"

[phani-srikar]

Hi @Nicolaidam
Here is the doc that explains what scopes are allowed and what do they mean: cognito-user-pools
Briefly, they are a way of managing permissions to access user data. More info can be found here: OAuth Scopes
Hope that helps.

[Nicolaidam]

Cool Thanks a lot @phani-srikar.

Is it a possibility with showSignIn to get the users firstName, like you can with the original Facebook Developer API?

[royjit]

You can get more user attributes using the user attribute api. If you are using a social provider, you need to map the attributes - https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-attribute-mapping.html

[Nicolaidam]

I've had luck with mapping attributes for email, first name and ID from Facebook. However I'm not able to get gender/birth. Is that maybe because the "profile" scope only gets a bit information from Facebook?

[phani-srikar]

The default profile scope in Facebook does not seem to include gender/birth FB docs

The fix for this issue has been merged in from this PR. Please update the SDK to get the changes. Closing this issue.