- Newest
- Most votes
- Most comments
The issue you're experiencing is likely related to token caching and propagation delays in AWS Cognito after performing user management operations. When you delete a federated user and then link them to an existing native Cognito user, there's a period where the system needs to fully propagate these changes across its infrastructure.
The "invalid_grant" error you're encountering during the token exchange process is probably due to this propagation delay. Cognito may still be processing the changes or clearing cached information related to the deleted federated user account.
The fact that this issue resolves itself after 15-20 minutes supports the theory that it's related to caching or propagation delays. The difference in behavior when deleting the federated user directly from the AWS console versus through the API could be due to different internal processes or priority levels for these operations.
Unfortunately, the methods you've tried (RevokeTokenAsync, AdminDisableUserAsync, and AdminUserGlobalSignOutAsync) don't seem to immediately resolve the issue. These operations are designed to invalidate tokens or disable user access, but they may not immediately clear all cached data across Cognito's distributed system.
To mitigate this issue, you could consider the following approaches:
-
Implement a retry mechanism in your application that attempts to exchange the authorization code for tokens multiple times over a period, with appropriate backoff intervals.
-
If possible, consider using the Pre-Sign Lambda function for this operation, as you mentioned it doesn't cause the same issue.
-
Introduce a delay in your application flow after deleting and linking the user before attempting to log in again. This delay could allow time for the changes to propagate.
-
Instead of deleting the federated user, you could try updating the user's attributes to link them to the native Cognito user. This might avoid the caching issues associated with deletion.
-
Reach out to AWS support for further investigation, as this behavior might be specific to your Cognito configuration or could be an edge case in Cognito's behavior that needs addressing.
Remember, when working with distributed systems like Cognito, it's important to design your application to handle temporary inconsistencies and propagation delays. Implementing appropriate error handling and retry logic can help manage these scenarios.
Sources
AdminUserGlobalSignOut - Amazon Cognito User Pools
GlobalSignOut - Amazon Cognito User Pools
Relevant content
- asked 3 years ago
If you delete a federated user in AWS and then link the same identity (e.g., email) to a Cognito native user, you'll get an invalid_grant error on next login for a short period. This happens because Cognito caches identity mappings, causing conflicts until the cache expires (usually within a few hours).