Cognito Id_token not processed when oidc is set to True

[rohit-nsit08]

I am trying to use this library with cognito and cognito requires response_type=token and returns both access_token and id_token. Library seems to have hardcoded the response_type for such scenario to be token id_token
https://github.com/darbio/angular-oauth2-oidc/blob/master/angular-oauth2-oidc/src/oauth-service.ts#L955-L957
Is there any workaround to make this work?
Thanks

[gwosty]

Just so it's clear to me, in order to make this work for Cognito would you have to set
requestType = 'token'
oicd = true

[jeroenheijmans]

@gwosty Currently you need to set oidc to false have the library ask for responseType of token. I'm not sure what other side-effects that would have.

In PR #397 a change is proposed that allows you to set responseType on the AuthConfig to override it, regardless of how oidc or requestAccesstoken are set. That PR is still open, but you could of course make your own build with that change included.

So before the PR:

if (this.oidc && this.requestAccessToken) {
    this.responseType = 'id_token token';
} else if (this.oidc && !this.requestAccessToken) {
    this.responseType = 'id_token';
} else {
    this.responseType = 'token';
}

After:

if (this.config.responseType) {
  this.responseType = this.config.responseType;
} else {
  if (this.oidc && this.requestAccessToken) {
      this.responseType = 'id_token token';
  } else if (this.oidc && !this.requestAccessToken) {
      this.responseType = 'id_token';
  } else {
      this.responseType = 'token';
  }
}

PS. You mention "requestType" but I've assumed you meant responseType. If it was intentional then my remarks are probably irrelevant.

[gwosty]

Sorry, yes, I meant the responseType. I think the pull request only fixes the call but not the actual saving of the token. In https://manfredsteyer.github.io/angular-oauth2-oidc/docs/injectables/OAuthService.html#source line 1314 we would not process the id_token if oidc is not set to true.

[rohit-nsit08]

I can confirm that Setting oidc true and handling responseType for cognito works. I was able to see both access token and id token.

[rohit-nsit08]

@manfredsteyer I can see that the pull request for this is still open. Is it ok that for now, If I import the project in my application and modify the source code for the fix? I believe the license is MIT as mentioned on the npm repository but I can't see any license header on the source file. Please treat this as a written request for your permission.

Thanks,

[manfredsteyer]

yes, it's absolutely ok. It's MIT. Will at a license file.