id token doesn't contain ClientMetadata after refresh

[rashidwiizb]

this way I m using signIn
"@aws-amplify/react-native": "^1.1.1",
"aws-amplify": "^6.3.1",
"react-native": "0.73.2",

const userSignIn = await signIn({
username: userName,
password: password,
options: {
clientMetadata: {
roleType: "Student"
}
}
});

I already attache pre token lambda trigger on Cognito for customise the id token . so I get the roleType in it on idTojeb when signing success . But when this idToken expires I get the new id token from amplify itself so in that idToken I didn't get this roleType

[mattcreaser]

Hi @rashidwiizb, react-native is actually part of the amplify-js project. I'll transfer this issue over to that repository.

[cwomack]

Hello, @rashidwiizb 👋. I think we may need to understand how your Auth flow is structured to better help here. How are you persisting the roleType field and attaching it to the iDToken? Can you share the lambda hook implementation and how to reproduce this? Thanks!

[TomMuehlegger]

We are facing the same issue. When providing the ClientMetadata to the signIn method, we are getting the right JWT token from Cognito (adding a claim, depending on the ClientMetadata, to the token via the PreTokenGeneration trigger in Cognito).

But when doing the fetchAuthSession({ forceRefresh: true }); via Amplify, the ClientMetadata is not provided to the PreTokenGeneration trigger and thus, this information is missing in the JWT token provided by the fetchAuthSession call.

We are using the latest "aws-amplify" version 6.3.2.
Thanks...

[rashidwiizb]

Hi @mattcreaser thanks for the reply.

@cwomack my pre-token lambda triggers is

const handler = async (event, context,callback) => {
  try {
        let roleType = '';
        if (event.triggerSource === 'TokenGeneration_Authentication') {
            roleType = event.request?.clientMetadata?.roleType;
            cachedRoleType = roleType;
        } else if (event.triggerSource === 'TokenGeneration_RefreshTokens') {
            roleType = cachedRoleType;
        }
        
        event.response = {
            claimsOverrideDetails: {
                claimsToAddOrOverride: {
                    'roleType': roleType
                },                
            },
        };

        return callback(null, event);
    } catch (error) {
        console.error('Error processing Pre Token Generation:', error);
        throw error;
    }
};

export { handler };

when I signin I pass the roleType in ClientMetadata and I get that roletype in idtoken,but when the idtoken is expires amplify itself refresh and get the new idtoken and access token but in that id token the roleType is empty strings "", that mean when refreshing the lambda doesn't get the ClientMetadata . Is there any way to fix this ?

[israx]

hello everyone. Passing clientMetadata while refreshing tokens is not supported at this time. However we are aware of this feature and will be working on it. I'll mark this issue as a feature request for now.