NotAuthorizedException: Client xxxxx is configured with secret but SECRET_HASH was not received #2504

Lumentus · 2023-07-04T11:48:22Z

Before opening, please confirm:

I have searched for duplicate or closed issues and discussions.

Language and Async Model

Kotlin - Coroutines

Amplify Categories

Authentication

Gradle script dependencies

implementation "com.amplifyframework:core-kotlin:2.8.7"
implementation "com.amplifyframework:aws-auth-cognito:2.8.7"

Environment information

Welcome to Gradle 8.0!

For more details see https://docs.gradle.org/8.0/release-notes.html

Gradle 8.0

Build time: 2023-02-13 13:15:21 UTC
Revision: 62ab9b7c7f884426cf79fbedcf07658b2dbe9e97

Kotlin: 1.8.10
Groovy: 3.0.13
Ant: Apache Ant(TM) version 1.10.11 compiled on July 10 2021
JVM: 11.0.15 (Homebrew 11.0.15+0)
OS: Mac OS X 13.4.1 aarch64

Please include any relevant guides or documentation you're referencing

No response

Describe the bug

Most often my test app crashes, when trying to signing into a cognito user pool with correct credentials. It crashes with a NotAuthorizedException with a message, that indicates that the SECRET_HASH was not retrieved, but it is given in the amplifyconfiguration.json. I know that it is not wrong, because sometimes the sign in works.

Reproduction steps (if applicable)

Install app with given activity.
Input correct credentials
Click sign in
Crash

Code Snippet

import android.os.Bundle
import android.util.Log
import androidx.activity.ComponentActivity
import androidx.activity.compose.setContent
import androidx.compose.foundation.layout.Arrangement
import androidx.compose.foundation.layout.Column
import androidx.compose.foundation.layout.fillMaxSize
import androidx.compose.material3.Button
import androidx.compose.material3.ExperimentalMaterial3Api
import androidx.compose.material3.MaterialTheme
import androidx.compose.material3.Surface
import androidx.compose.material3.Text
import androidx.compose.material3.TextField
import androidx.compose.runtime.Composable
import androidx.compose.runtime.collectAsState
import androidx.compose.runtime.getValue
import androidx.compose.runtime.mutableStateOf
import androidx.compose.runtime.remember
import androidx.compose.runtime.setValue
import androidx.compose.ui.Modifier
import androidx.lifecycle.lifecycleScope
import com.amplifyframework.auth.AuthChannelEventName
import com.amplifyframework.auth.cognito.AWSCognitoAuthPlugin
import com.amplifyframework.core.AmplifyConfiguration
import com.amplifyframework.core.InitializationStatus
import com.amplifyframework.hub.HubChannel
import com.amplifyframework.kotlin.core.Amplify
import com.amplifyframework.logging.AndroidLoggingPlugin
import com.amplifyframework.logging.LogLevel
import kotlinx.coroutines.Dispatchers
import kotlinx.coroutines.Job
import kotlinx.coroutines.flow.MutableStateFlow
import kotlinx.coroutines.launch

class MainActivity : ComponentActivity() {
    val signedIn = MutableStateFlow(false)
    val username = MutableStateFlow<String?>(null)

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)

        startAuthEventObservation()
        Amplify.addPlugin(AWSCognitoAuthPlugin())
        Amplify.addPlugin(AndroidLoggingPlugin(LogLevel.VERBOSE))
        Amplify.configure( this)

        setContent {
            MaterialTheme {
                // A surface container using the 'background' color from the theme
                Surface(modifier = Modifier.fillMaxSize(), color = MaterialTheme.colorScheme.background) {
                    val signedIn = this.signedIn.collectAsState()
                    if (signedIn.value) {
                        val username = this.username.collectAsState()
                        SignedIn(username = username.value ?: "") {
                            lifecycleScope.launch(Dispatchers.Default) {
                                Amplify.Auth.signOut()
                            }
                        }
                    } else {
                        SignIn { username, password ->
                            this.lifecycleScope.launch(Dispatchers.Default) {
                                val result = Amplify.Auth.signIn(username, password)
                                Log.i("Sign in", "Result: ${result.isSignedIn}")
                            }
                        }
                    }
                }
            }
        }
    }

    var authSubJob: Job? = null

    fun startAuthEventObservation() {
        authSubJob = lifecycleScope.launch(Dispatchers.Default) {
            Amplify.Hub.subscribe(HubChannel.AUTH).collect { event ->
                when (event.name) {
                    InitializationStatus.SUCCEEDED.toString() -> {
                        Log.d("LogTag.BACKEND_SERVICE", "Auth successfully initialized")
                        val session = Amplify.Auth.fetchAuthSession()
                        if (session.isSignedIn) {
                            onSignedIn()
                        }
                    }

                    InitializationStatus.FAILED.toString() ->
                        Log.d("LogTag.BACKEND_SERVICE", "Auth failed to initialize")

                    else -> when (AuthChannelEventName.valueOf(event.name)) {
                        AuthChannelEventName.SIGNED_IN -> onSignedIn()

                        AuthChannelEventName.SIGNED_OUT -> onSignedOut()

                        else -> {
                            Log.d("AuthEvent", "${event.name}")
                        }
                    }
                }
            }
        }
    }

    suspend fun onSignedIn() {
        val user = Amplify.Auth.getCurrentUser()
        username.value = user.username
        signedIn.value = true
    }

    fun onSignedOut() {
        signedIn.value = false
        username.value = null
    }
}

@OptIn(ExperimentalMaterial3Api::class)
@Composable
fun SignIn(modifier: Modifier = Modifier, signInAction: (String, String) -> Unit) {
    var username by remember {
        mutableStateOf("")
    }
    var password by remember {
        mutableStateOf("")
    }
    Column(modifier = modifier) {
        TextField(value = username, onValueChange = { username = it })
        TextField(value = password, onValueChange = { password = it })
        Button(onClick = {
            signInAction(username, password)
        }) {
            Text("Sign in")
        }
    }
}

@Composable
fun SignedIn(username: String, modifier: Modifier = Modifier, signedOutAction: () -> Unit) {
    Column(modifier = modifier, verticalArrangement = Arrangement.Center) {
        Text(
            text = "Hello $username!",
        )
        Button(onClick = { signedOutAction() }) {
            Text(text = "Sign out")
        }
    }
}

Log output

State machine output when the sign in crashes immediately:

amplify:aw...AuthPlugin package V Auth State Change: NotConfigured(id=)

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuth(id=)

amplify:aw...AuthPlugin package V InitAuthConfig Starting execution

amplify:aw...AuthPlugin package V Credential Store State Change: MigratingLegacyStore(id=)

amplify:aw...AuthPlugin package V Credential Store State Change: NotConfigured(id=)

amplify:aw...AuthPlugin package V MigrateLegacyCredentials Starting execution

amplify:aw...AuthPlugin package V MigrateLegacyCredentials Sending event LoadCredentialStore

amplify:aw...AuthPlugin package V Credential Store State Change: LoadingStoredCredentials(id=)

amplify:aw...AuthPlugin package V LoadCredentialStore Starting execution

amplify:aw...AuthPlugin package V LoadCredentialStore Sending event CompletedOperation

amplify:aw...AuthPlugin package V Credential Store State Change: Success(storedCredentials=com.amplifyframework.statemachine.codegen.data.AmplifyCredential$Empty@407de40)

amplify:aw...AuthPlugin package V MoveToIdleState Starting execution

amplify:aw...AuthPlugin package V MoveToIdleState Sending event MoveToIdleState

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V InitAuthConfig Sending event ConfigureAuthentication

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuthentication(authNState=NotConfigured(id=))

amplify:aw...AuthPlugin package V InitAuthNConfig Starting execution

amplify:aw...AuthPlugin package V InitAuthNConfig Sending event Configure

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuthentication(authNState=Configured(id=))

amplify:aw...AuthPlugin package V ConfigureAuthN Starting execution

amplify:aw...AuthPlugin package V ConfigureAuthN Sending event InitializedSignedOut

amplify:aw...AuthPlugin package V ConfigureAuthN Sending event ConfiguredAuthentication

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuthentication(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)))

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuthorization(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=NotConfigured(id=))

amplify:aw...AuthPlugin package V InitAuthZConfig Starting execution

amplify:aw...AuthPlugin package V InitAuthZConfig Sending event Configure

amplify:aw...AuthPlugin package V Auth State Change: ConfiguringAuthorization(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=Configured(id=))

amplify:aw...AuthPlugin package V ConfigureAuthZ Starting execution

amplify:aw...AuthPlugin package V ConfigureAuthZ Sending event ConfiguredAuthorization

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=Configured(id=))

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=FetchingUnAuthSession(fetchAuthSessionState=NotStarted(id=)))

amplify:aw...AuthPlugin package V InitFetchUnAuthSession Starting execution

amplify:aw...AuthPlugin package V InitFetchUnAuthSession Sending event FetchIdentity

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=FetchingUnAuthSession(fetchAuthSessionState=FetchingIdentity(logins=UnAuthLogins(logins={}))))

amplify:aw...AuthPlugin package V FetchIdentity Starting execution

amplify:aw...AuthPlugin package V FetchIdentity Sending event FetchAwsCredentials

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=FetchingUnAuthSession(fetchAuthSessionState=FetchingAWSCredentials(identityId=eu-central-1:7ec1e01b-751f-473f-baf4-a4e086a22a10, logins=UnAuthLogins(logins={}))))

amplify:aw...AuthPlugin package V FetchAWSCredentials Starting execution

amplify:aw...AuthPlugin package V FetchAWSCredentials Sending event Fetched

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=FetchingUnAuthSession(fetchAuthSessionState=Fetched(id=)))

amplify:aw...AuthPlugin package V NotifySessionEstablished Starting execution

amplify:aw...AuthPlugin package V NotifySessionEstablished Sending event Fetched

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=StoringCredentials(amplifyCredential=IdentityPool(identityId=eu-central-1:7ec1e01b-751f-473f-baf4-a4e086a22a10, credentials=AWSCredentials(accessKeyId = ASIAU***, secretAccessKey = 0OYVI***, sessionToken = IQoJb***, expiration = 1688623277))))

amplify:aw...AuthPlugin package V PersistCredentials Starting execution

amplify:aw...AuthPlugin package V Credential Store State Change: StoringCredentials(id=)

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V StoreCredentials Starting execution

amplify:aw...AuthPlugin package V StoreCredentials Sending event CompletedOperation

amplify:aw...AuthPlugin package V Credential Store State Change: Success(storedCredentials=IdentityPool(identityId=eu-central-1:7ec1e01b-751f-473f-baf4-a4e086a22a10, credentials=AWSCredentials(accessKeyId = ASIAU***, secretAccessKey = 0OYVI***, sessionToken = IQoJb***, expiration = 1688623277)))

amplify:aw...AuthPlugin package V MoveToIdleState Starting execution

amplify:aw...AuthPlugin package V MoveToIdleState Sending event MoveToIdleState

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V PersistCredentials Sending event ReceivedCachedCredentials

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SignedOut(signedOutData=SignedOutData(lastKnownUsername=null, hostedUIErrorData=null, globalSignOutErrorData=null, revokeTokenErrorData=null)), authZState=SessionEstablished(amplifyCredential=IdentityPool(identityId=eu-central-1:7ec1e01b-751f-473f-baf4-a4e086a22a10, credentials=AWSCredentials(accessKeyId = ASIAU***, secretAccessKey = 0OYVI***, sessionToken = IQoJb***, expiration = 1688623277))))

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SigningIn(signInState=NotStarted(id=)), authZState=SigningIn(id=))

amplify:aw...AuthPlugin package V InitiateSignInAction Starting execution

amplify:aw...AuthPlugin package V InitiateSignInAction Sending event InitiateSignInWithSRP

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SigningIn(signInState=SigningInWithSRP(srpSignInState=NotStarted(id=))), authZState=SigningIn(id=))

amplify:aw...AuthPlugin package V StartSRPAuth Starting execution

amplify:aw...AuthPlugin package V StartSRPAuth Sending event InitiateSRP

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SigningIn(signInState=SigningInWithSRP(srpSignInState=InitiatingSRPA(id=))), authZState=SigningIn(id=))

amplify:aw...AuthPlugin package V InitSRPAuth Starting execution

amplify:aw...AuthPlugin package V Credential Store State Change: LoadingStoredCredentials(id=)

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V LoadCredentialStore Starting execution

amplify:aw...AuthPlugin package V LoadCredentialStore Sending event CompletedOperation

amplify:aw...AuthPlugin package V Credential Store State Change: Success(storedCredentials=ASFDevice(id=3b1bf288-11aa-4396-a8f0-cf4b2419b3a7:1688471811357))

amplify:aw...AuthPlugin package V MoveToIdleState Starting execution

amplify:aw...AuthPlugin package V MoveToIdleState Sending event MoveToIdleState

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V Credential Store State Change: LoadingStoredCredentials(id=)

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V LoadCredentialStore Starting execution

amplify:aw...AuthPlugin package V LoadCredentialStore Sending event CompletedOperation

amplify:aw...AuthPlugin package V Credential Store State Change: Success(storedCredentials=DeviceData(deviceMetadata=Metadata(deviceKey=eu-central-1_4d0a869d-170f-44ff-a738-88598b619cdb, deviceGroupKey=-LnOiy5R8, deviceSecret=653e2e6c-6ebc-4f90-a60a-99cbb53f660a)))

amplify:aw...AuthPlugin package V MoveToIdleState Starting execution

amplify:aw...AuthPlugin package V MoveToIdleState Sending event MoveToIdleState

amplify:aw...AuthPlugin package V Credential Store State Change: Idle(id=)

amplify:aw...AuthPlugin package V InitSRPAuth Sending event RespondPasswordVerifier

amplify:aw...AuthPlugin package V Auth State Change: Configured(authNState=SigningIn(signInState=SigningInWithSRP(srpSignInState=RespondingPasswordVerifier(id=))), authZState=SigningIn(id=))

amplify:aw...AuthPlugin package VerifyPasswordSRP Starting execution