Unable to login on iOS, works on Android

[francescopedronomnys]

Describe the bug

We have an application that is both for Android and iOS. We also have two environments: staging and production.
In staging both iOS and Android application can log in successfully.
In production Android application works, but on iOS application we are not able to log in users.
This is the message we get:

"Incorrect username or password"

We suppose that production config on iOS is correct because user registration on iOS is working.

Steps To Reproduce

This is our login code:

import Amplify
import AWSPluginsCore
import Combine
import CombineExt
import Foundation

class LoginViewModel: BaseViewModel {
    @Published var loginStatus: LoginStatus = .idle

    enum LoginStatus: Equatable {
        case idle
        case error(desc: String)
        case loading
        case success
    }

    func login(email: String, password: String) {
        loginStatus = .loading
        Amplify.Publisher.create {
            //_ = await Amplify.Auth.signOut()
            _ = try await Amplify.Auth.signIn(username: email.lowercased(), password: password)
        }
        .flatMap {
            Amplify.Publisher.create {
                try await Amplify.Auth.fetchAuthSession()
            }
            .tryMap {
                if let cognitoTokenProvider = $0 as? AuthCognitoTokensProvider,
                   let tokens = try? cognitoTokenProvider.getCognitoTokens().get() {
                    appLog("Id token - \(tokens.accessToken) ")

                    GlobalSettings.accessToken = tokens.accessToken
                }
                return $0.isSignedIn
            }
        }
        .sinkOnMain(receiveFailure: { error in
            self.loginStatus = .error(desc: self.getErrorDescription(from: error))
        }, receiveValue: { self.loginStatus = $0 ? .success : .error(desc: .init(localized: "generic_error")) })
        .store(in: &subscribers)
    }
}

### Expected behavior

User is authenticated

### Amplify Framework Version

2.45.0

### Amplify Categories

Auth

### Dependency manager

Swift PM

### Swift version

5

### CLI version

--

### Xcode version

16.1

### Relevant log output

```shell
<details>
<summary>Relevant log</summary>


[APP ERROR 🔴] LoginView.swift - body - line 85
loginStatus: error: Incorrect username or password.
2024-12-04 17:33:07.976093+0100 -prod[495:19561] [AuthenticationAWSCognitoAuthPlugin] Auth state change:

{
    "AuthState.configured" =     {
        "AuthenticationState.signingIn" =         {
            "SignInState.signingInWithSRP" =             {
                "SRPSignInState.error" =                 {
                    Error = "AWSCognitoAuthPlugin.SignInError.service(error: AWSCognitoIdentityProvider.NotAuthorizedException(properties: AWSCognitoIdentityProvider.NotAuthorizedException.Properties(message: Optional(\"Incorrect username or password.\")), httpResponse: \nStatus Code: HTTP status code: 400 \n x-amzn-errormessage: Incorrect username or password., \nx-amzn-requestid: e7e0b232-6215-4611-b1f5-bf04243e5a73, \nContent-Length: 79, \nDate: Wed, 04 Dec 2024 16:33:07 GMT, \nContent-Type: application/x-amz-json-1.1, \nx-amzn-errortype: NotAuthorizedException:, message: nil, requestID: nil))";
                };
                clientMetadata =                 {
                };
                password = "<REDACTED>";
                session = "";
                signInMethod = "AWSCognitoAuthPlugin.SignInMethod.apiBased(AWSCognitoAuthPlugin.AuthFlowType.userSRP)";
                username = "om************om";
            };
        };
        "AuthorizationState.configured" =         {
        };
        "SignUpState.notStarted" =         {
        };
    };
}
2024-12-04 17:33:07.976667+0100 -prod[495:19561] [AuthenticationAWSCognitoAuthPlugin] Auth state change:

{
    "AuthState.configured" =     {
        "AuthenticationState.signedOut" =         {
            lastKnownUserName = "(nil)";
        };
        "AuthorizationState.configured" =         {
        };
        "SignUpState.notStarted" =         {
        };
    };
}

```

Is this a regression?

No

Regression additional context

No response

Platforms

iOS

OS Version

16.7.10

Device

iPhoneX

Specific to simulators

No response

Additional context

No response

[francescopedronomnys]

fulllog.txt
This is the full log for the session, from app startup until the failed login

[harsh62]

@francescopedronomnys Do you think email.lowercased() could be an issue? Usernames in Cognito are case sensitive by default.

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-case-sensitivity.html

[francescopedronomnys]

@harsh62 thanks for pointing that out, but unfortunately I've already checked it and that's not our issue.
The username I'm using is all lower case and during registration we force the username to lower case.
Anyway I've also tried removing .lowercased() from our LoginViewModel and the issue remains.

[harsh62]

@francescopedronomnys

• In that case can you please provide me details on how the backend is created, Gen2 or Gen1 and share the steps that you used to create the backend?
• amplify configuration or outputs file based on how it was created? (redacted all the sensitive information)
• Also are you able to validate if the issue also occurs in prior version 2.43.0 and 2.44.0? this will help me narrow down my investigation.

[harsh62]

@francescopedronomnys
One more thing, could you also share how the Android login API is being triggered and with what parameters?

[francescopedronomnys]

In that case can you please provide me details on how the backend is created, Gen2 or Gen1 and share the steps that you used to create the backend?

Details will be provided by a colleague of mine

amplify configuration or outputs file based on how it was created? (redacted all the sensitive information)

This is how we are initializing Amplify on the iOS app (on android we are using amplifyconfiguration.json file):

let config = AmplifyConfiguration(auth: .init(plugins: amplifyProd))
private static var amplifyProd: [String: JSONValue] = [
        "awsCognitoAuthPlugin": [
            "CognitoUserPool": [
                "Default": [
                    "PoolId": "eu-west-1_dqf9NuhhX",
                    "AppClientId": "66adu7pmpdavnsmfl0i8dq42h6",
                    "Region": "eu-west-1"]
            ],
            "Auth": [
                "Default": [
                    "authenticationFlowType": "USER_PASSWORD_AUTH"]
            ]]
    ]

Also are you able to validate if the issue also occurs in prior version 2.43.0 and 2.44.0? this will help me narrow down my investigation.

We recently updated from 2.27.0 to 2.45.0 becase we had the issue on 2.27.0 and was trying the latest version to understand if that works.

One more thing, could you also share how the Android login API is being triggered and with what parameters?
Sure, here's the amplifyconfiguration.json file:

{
  "auth": {
    "plugins": {
      "awsCognitoAuthPlugin": {
        "CognitoUserPool": {
          "Default": {
            "PoolId": "eu-west-1_dqf9NuhhX",
            "AppClientId": "66adu7pmpdavnsmfl0i8dq42h6",
            "Region": "eu-west-1"
          }
        },
        "Auth": {
          "Default": {
            "authenticationFlowType": "USER_PASSWORD_AUTH"
          }
        }
      }
    }
  }
}

and here's the login code:
(as you can see we do a logout before logging in, that was done also on iOS, but commented trying to remove all possible soruces of error)

class AuthRepository @Inject constructor(
    private val authTokenProvider: AuthTokenProvider,
    private val cachePrefs: CachePrefs,
) {
    val isUserLoggedFlow = authTokenProvider.isLoggedFlow

    fun doLogin(email: String, password: String, onSignInResult: (AuthenticationResult) -> Unit) {
        Amplify.Auth.signOut {
            Amplify.Auth.signIn(
                email, password,
                {
                    onSignInResult(AuthenticationResult.Success(it))
                },
                {
                    onSignInResult(AuthenticationResult.Error(it))
                },
            )
        }
    }
}

[gab78]

@harsh62 Hi, I'm working with @francescopedronomnys at the project and I've setted up all the Cognito stuff.
We do not create any Amplify app (for backend and frontend) but simply use Amplify.auth to authenticate on Cognito UserPool.

We have a Java SpringBoot backend Application acting as Resource Server and 4 lambda functions for customize the Cognito flows (but we have already checked that lambdas are ok)
The IOS App does not interact with the Spring Backend to login: it calls Cognito directly, using Amplify.Auth library

Please, notice that everything works with Android and with a React SPA
Also notice that the same identical stuff works even with IOS in our development AWS account

Below the Terraform module code that creates all the Cognito resources:

resource "aws_cognito_user_pool" "user_pool" {
  name 						= "${var.project_prefix}-${var.user_pool_name}-${var.env}"
  mfa_configuration         = "OFF"
  deletion_protection		= "INACTIVE"
  password_policy {
  	minimum_length 		= var.password_length
  	require_lowercase	= true
  	require_uppercase	= true
  	require_numbers		= true
  	require_symbols		= false
  	temporary_password_validity_days = var.temporary_password_validity_days
  }		
  
  username_attributes 		= [ "email" ]
  auto_verified_attributes 	= [ "email" ]
  
  user_attribute_update_settings {
    attributes_require_verification_before_update = [ "email" ]
  }
  
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "email"
    required                 	= true

    string_attribute_constraints {
      min_length = 1
      max_length = 256
    }
  }
  
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "family_name"
    required                 	= true

    string_attribute_constraints {
      min_length = 1
      max_length = 256
    }
  }
  
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "given_name"
    required                 	= true

    string_attribute_constraints {
      min_length = 1
      max_length = 256
    }
  }
  
  ############################
  # Brand (Emak/Efco/Oleomac...)
  ############################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "signup_brand"
    required                 	= false

    string_attribute_constraints {
      max_length = 256
    }
  }
  
  ###############################
  # Lingua
  ###############################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "lang"
    required                 	= false

    string_attribute_constraints {
      max_length = 10
    }
  }
  
  #############################################
  # Accettazione Privacy
  #############################################
  schema {
  	attribute_data_type      	= "Boolean"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "privacy"
    required                 	= false
  }
  
  #############################################
  # Partita IVA
  #############################################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "vat_number"
    required                 	= false
    
    string_attribute_constraints {
      max_length = 50
    }
  }
  
  #############################################
  # Stato Dealer
  #############################################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "company_country"
    required                 	= false
    
    string_attribute_constraints {
      max_length = 256
    }
  }
  
  #############################################
  # Rag sociale
  #############################################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "company_name"
    required                 	= false
    
    string_attribute_constraints {
      max_length = 2048
    }
  }
  
  #############################################
  # Indirizzo
  #############################################
  schema {
  	attribute_data_type      	= "String"
    developer_only_attribute 	= false
    mutable                  	= true
    name                     	= "company_address"
    required                 	= false
    
    string_attribute_constraints {
      max_length = 2048
    }
  }
  
  admin_create_user_config {
  	allow_admin_create_user_only = false
  }
  
  email_configuration {
  	email_sending_account 	= "DEVELOPER"  #Use SES
  	from_email_address		= var.email_sender
  	source_arn				= var.ses_verified_identity_arn
  }
  	
  account_recovery_setting {
  	recovery_mechanism {
    	name     = "verified_email"
      	priority = 1
    }
  }
	
  lambda_config {
  	custom_message 		= var.lambda_custom_message_function
  	post_confirmation 	= var.lambda_post_confirmation_function
  	pre_authentication  = var.lambda_pre_authentication_function
  	pre_sign_up			= var.lambda_pre_signup_function
  }
  
  username_configuration {
    case_sensitive = false
  }
  
  verification_message_template {
  	default_email_option = "CONFIRM_WITH_CODE"
  }
  
  lifecycle {
    ignore_changes = [
      password_policy
    ]
  }
}

###########################################
# Cognito domain
###########################################
resource "aws_cognito_user_pool_domain" "user_pool_domain" {
  domain       = var.custom_domain != null ? var.custom_domain : "${var.project_prefix}-${var.user_pool_name}-${var.env}"
  user_pool_id = aws_cognito_user_pool.user_pool.id
  certificate_arn = var.certificate_arn!=null && var.custom_domain != null ? var.certificate_arn : null
}

data "aws_route53_zone" "zone" {
  count = var.custom_domain!=null ? 1 : 0
  name = var.custom_domain
}

resource "aws_route53_record" "auth-cognito-A" {
  count =  var.custom_domain!=null ? 1 : 0
  name    = aws_cognito_user_pool_domain.user_pool_domain.domain
  type    = "A"
  zone_id = data.aws_route53_zone.zone[0].zone_id
  alias {
    evaluate_target_health = false

    name    = aws_cognito_user_pool_domain.user_pool_domain.cloudfront_distribution
    zone_id = aws_cognito_user_pool_domain.user_pool_domain.cloudfront_distribution_zone_id
  }
}

###########################################
# Cognito userPool clients
###########################################
resource "aws_cognito_user_pool_client" "ui_client" {
  
  for_each = { for a in var.apps: a.client_id => a }
	  name 									= each.value.client_id
	
	  user_pool_id 							  = aws_cognito_user_pool.user_pool.id
	  generate_secret 						= false
	  refresh_token_validity 				= 90
	  prevent_user_existence_errors 		= "ENABLED"
	  allowed_oauth_flows_user_pool_client 	= true
	  allowed_oauth_flows                  	= ["code", "implicit"]

    allowed_oauth_scopes                 	= setunion( ["email", "openid"],aws_cognito_resource_server.api_resource[0].scope_identifiers)

	  supported_identity_providers         	= var.google_id_provider!=null ? ["COGNITO", "Google"] : ["COGNITO"]
	  enable_token_revocation				= true
	  
	  explicit_auth_flows = [
	    "ALLOW_REFRESH_TOKEN_AUTH",
	    "ALLOW_USER_PASSWORD_AUTH",
	    "ALLOW_ADMIN_USER_PASSWORD_AUTH",
	    "ALLOW_CUSTOM_AUTH",
	    "ALLOW_USER_SRP_AUTH"
	  ]
		
	  callback_urls = [ each.value.login_success_callback_url ]	
}

########################################
# User groups
########################################
resource "aws_cognito_user_group" "groups" {
	for_each = { for g in var.user_groups: g.name => g }
	  name         = each.value.name
	  precedence   = each.value.priority
	  description  = each.value.description
	  user_pool_id = aws_cognito_user_pool.user_pool.id
}

########################################
# Resource server
########################################
resource "aws_cognito_resource_server" "resource" {
  name       = "${var.project_prefix}-rest-api"
  user_pool_id = aws_cognito_user_pool.user_pool.id
  identifier = var.resource_server_urls.remote
}

resource "aws_cognito_resource_server" "local_resource" {
  count =  var.resource_server_urls.local!=null ? 1 : 0
  name       = "${var.project_prefix}-rest-api-local"
  user_pool_id = aws_cognito_user_pool.user_pool.id
  identifier = var.resource_server_urls.local
}

resource "aws_cognito_resource_server" "api_resource" {
  count =  var.resource_server_urls.api!=null ? 1 : 0
  name       = "${var.project_prefix}-rest-api-gw"
  user_pool_id = aws_cognito_user_pool.user_pool.id
  identifier = var.resource_server_urls.api
  scope {
    scope_name        = "api_gw"
    scope_description = "scope to allow API-gw authorizer"
  }
}

and here is the values passed to the module and the lambda functions...

#---------------------------------------
# User Pool
# On "dev" environment creates a local copy of each client in order 
# to run applications locally with dev user-pool
#---------------------------------------
locals {
  ses_sender_arn    = module.emak_ses.domain_sender_arn!=null ? module.emak_ses.domain_sender_arn : module.emak_ses.default_email_sender_arn
}

module "emak_iot_cognito_user_pool" {
  source                             = "../../modules/emak-iot-cognito-user-pool"
  aws_region                         = local.aws_region
  project_prefix                     = local.project_prefix
  env                                = local.env
  aws_account_id                     = local.aws_account_id
  user_pool_name                     = "users"
  password_length                    = 8
  email_sender                       = local.ses_email_sender
  ses_verified_identity_arn          = local.ses_sender_arn
  #google_id_provider                 = local.google_id_provider
  lambda_post_confirmation_function  = module.emak_iot_lambda_cognito_post_confirm.lambda_arn
  lambda_custom_message_function     = module.emak_iot_lambda_cognito_custom_message.lambda_arn
  lambda_pre_authentication_function = module.emak_iot_lambda_cognito_pre_auth.lambda_arn
  lambda_pre_signup_function         = module.emak_iot_lambda_cognito_pre_signup.lambda_arn
  #admin_user_email                   = local.admin_user_email
  #admin_user_group                   = "ADMIN"

  apps = [
    { client_id = "${local.project_prefix}-web-ui-${local.env}", login_success_callback_url = "https://${module.emak_iot_web_ui_stack.static_ui_domain_name}/dashboard" },
    { client_id = "${local.project_prefix}-app-dealer-${local.env}", login_success_callback_url = "https://${module.emak_iot_web_ui_stack.static_ui_domain_name}/dashboard" },
    { client_id = "${local.project_prefix}-app-efco-${local.env}", login_success_callback_url = "https://${module.emak_iot_web_ui_stack.static_ui_domain_name}/dashboard" },
    { client_id = "${local.project_prefix}-app-oleomac-${local.env}", login_success_callback_url = "https://${module.emak_iot_web_ui_stack.static_ui_domain_name}/dashboard" }

  ]

  resource_server_urls = {
    #local  = "http://localhost:8080",
    remote = "${module.emak_iot_web_ui_stack.api_rest_base_url}"
    api    = "ApiGateway"
  }

  user_groups = [
    { name = "ADMIN", priority = 0, description = "Administrators" },
    { name = "OPERATOR", priority = 1, description = "Internal Users" },
    { name = "DEALER", priority = 2, description = "Dealers" },
    { name = "USER", priority = 3, description = "Customers" }
  ]
}

#--------------------------------------
# EventBridge per tener vive le lambda 
# https://stackoverflow.com/questions/77691071/how-do-i-avoid-the-snapstartnotreadyexception-error-on-the-first-request-after-1
#--------------------------------------
resource "aws_cloudwatch_event_rule" "event" {
  name          = "emak-iot-lambda-healthcheck"
  description   = "Health Check event to keep SnapStart Java Lambda working"
  schedule_expression = "rate(13 days)"
}

#--------------------------------------------
# Lambda event processor
#--------------------------------------------
module "emak_iot_lambda_cognito_event_processor" {
  source                        = "../../modules/emak-iot-lambda-cognito-event-processor"
  aws_region                    = local.aws_region
  project_prefix                = "emak-iot"
  env                           = local.env
  aws_account_id                = local.aws_account_id
  email_template                = module.emak_ses.emak_generic_email_template_name
  email_sender                  = local.ses_email_sender
  backoffice_email              = local.backoffice_email
  require_admin_approval_groups = "DEALER,OPERATOR"
  lambda_repo                   = module.emak_lambda_repo.repo_name
  user_info_table               = module.emak_dynamo_db.user_info_table_name

  #groups_map					= "{\"${local.project_prefix}-web-ui-${local.env}\":\"OPERATOR\",\"${local.project_prefix}-app-dealer-${local.env}\":\"DEALER\",\"${local.project_prefix}-app-efco-${local.env}\":\"USER\"}"

  groups_map = jsonencode({
    "${local.project_prefix}-web-ui-${local.env}"     = "OPERATOR"
    "${local.project_prefix}-app-dealer-${local.env}" = "DEALER"
    "${local.project_prefix}-app-efco-${local.env}"   = "USER"
    "${local.project_prefix}-app-oleomac-${local.env}"   = "USER"
  })
  
  health_event							= { name = aws_cloudwatch_event_rule.event.name
  											arn = aws_cloudwatch_event_rule.event.arn }
}

#-----------------------------------------
# Lambda Post-confirm
#-----------------------------------------
module "emak_iot_lambda_cognito_post_confirm" {
  source                        = "../../modules/emak-iot-lambda-cognito-post-confirm"
  aws_region                    = local.aws_region
  project_prefix                = "emak-iot"
  env                           = local.env
  aws_account_id                = local.aws_account_id
  queue_name                    = module.emak_iot_lambda_cognito_event_processor.queue_name
  lambda_repo                   = module.emak_lambda_repo.repo_name
  user_pool                     = module.emak_iot_cognito_user_pool.user_pool_arn
  require_admin_approval_groups = "DEALER,OPERATOR"

  groups_map = jsonencode({
    "${local.project_prefix}-web-ui-${local.env}"     = "OPERATOR"
    "${local.project_prefix}-app-dealer-${local.env}" = "DEALER"
    "${local.project_prefix}-app-efco-${local.env}"   = "USER"
    "${local.project_prefix}-app-oleomac-${local.env}"   = "USER"
  })
  
  health_event							= { name = aws_cloudwatch_event_rule.event.name
  											arn = aws_cloudwatch_event_rule.event.arn }
}

#------------------------------------------
# Custom-message Lambda function 
#------------------------------------------
module "emak_iot_lambda_cognito_custom_message" {
  source         = "../../modules/emak-iot-lambda-cognito-custom-message"
  aws_region     = local.aws_region
  project_prefix = local.project_prefix
  env            = local.env
  aws_account_id = local.aws_account_id
  email_template = module.emak_ses.emak_generic_email_template_name
  lambda_repo    = module.emak_lambda_repo.repo_name
  user_pool      = module.emak_iot_cognito_user_pool.user_pool_arn

  groups_map = jsonencode({
    "${local.project_prefix}-web-ui-${local.env}"     = "OPERATOR,ADMIN"
    "${local.project_prefix}-app-dealer-${local.env}" = "DEALER"
    "${local.project_prefix}-app-efco-${local.env}"   = "USER"
    "${local.project_prefix}-app-oleomac-${local.env}"   = "USER"
  })
  
  health_event							= { name = aws_cloudwatch_event_rule.event.name
  											arn = aws_cloudwatch_event_rule.event.arn }
}

#-----------------------------------------
# Lambda Pre-Auth
#-----------------------------------------
module "emak_iot_lambda_cognito_pre_auth" {
  source         = "../../modules/emak-iot-lambda-cognito-pre-auth"
  aws_region     = local.aws_region
  project_prefix = "emak-iot"
  env            = local.env
  aws_account_id = local.aws_account_id
  lambda_repo    = module.emak_lambda_repo.repo_name
  user_pool      = module.emak_iot_cognito_user_pool.user_pool_arn

  groups_map = jsonencode({
    "${local.project_prefix}-web-ui-${local.env}"     = "OPERATOR,ADMIN"
    "${local.project_prefix}-app-dealer-${local.env}" = "DEALER"
    "${local.project_prefix}-app-efco-${local.env}"   = "USER"
    "${local.project_prefix}-app-oleomac-${local.env}"   = "USER"
  })
  
  health_event							= { name = aws_cloudwatch_event_rule.event.name
  											arn = aws_cloudwatch_event_rule.event.arn }
}

#-----------------------------------------
# Lambda Pre-Signup
#-----------------------------------------
module "emak_iot_lambda_cognito_pre_signup" {
  source                    = "../../modules/emak-iot-lambda-cognito-pre-signup"
  aws_region                = local.aws_region
  project_prefix            = "emak-iot"
  env                       = local.env
  aws_account_id            = local.aws_account_id
  lambda_repo               = module.emak_lambda_repo.repo_name
  user_pool                 = module.emak_iot_cognito_user_pool.user_pool_arn
  custom_validation_clients = "${local.project_prefix}-app-dealer"
  
  health_event							= { name = aws_cloudwatch_event_rule.event.name
  											arn = aws_cloudwatch_event_rule.event.arn }
}

[harsh62]

Thanks for all the information.. I am investigating and will get back to you soon.