Cognito provider - "id_token not present in TokenSet"

[davemackintosh]

Hi all,

After some fiddling around I've gotten next-auth to work quite nicely. All except for when I successfully sign in, I always get the error

id_token not present in TokenSet

Scopes are set up according to docs and other discussions I've found on here and Google. I've verified all the config parameters and tried a few variations of config. It seems to me that this error occurs in the next-auth callback for this provider.

If I try to go to a protected page, I can see I am in fact logged in and it all works (I can also see in the debug logs the appropriate data from the [next-auth][debug][OAUTH_CALLBACK_RESPONSE]) but the action of logging in doesn't seem to work.

I've added some logging to trace through the source a bit but couldn't find anything useful to go from. Am I doing something wrong or should I post an issue?

Here's the error

TokenSet {}
[next-auth][error][OAUTH_CALLBACK_ERROR]
https://next-auth.js.org/errors#oauth_callback_error id_token not present in TokenSet {
  error: {
    message: 'id_token not present in TokenSet',
    stack: 'TypeError: id_token not present in TokenSet\n' +
      '    at TokenSet.claims (/Users/dave/www/go/wikisync/web/node_modules/openid-client/lib/token_set.js:24:10)\n' +
      '    at oAuthCallback (/Users/dave/www/go/wikisync/web/node_modules/next-auth/core/lib/oauth/callback.js:131:21)\n' +
      '    at processTicksAndRejections (node:internal/process/task_queues:96:5)\n' +
      '    at async Object.callback (/Users/dave/www/go/wikisync/web/node_modules/next-auth/core/routes/callback.js:50:11)\n' +
      '    at async NextAuthHandler (/Users/dave/www/go/wikisync/web/node_modules/next-auth/core/index.js:178:28)\n' +
      '    at async NextAuthNextHandler (/Users/dave/www/go/wikisync/web/node_modules/next-auth/next/index.js:23:19)\n' +
      '    at async /Users/dave/www/go/wikisync/web/node_modules/next-auth/next/index.js:59:32\n' +
      '    at async Object.apiResolver (/Users/dave/www/go/wikisync/web/node_modules/next/dist/server/api-utils/node.js:179:9)\n' +
      '    at async DevServer.runApi (/Users/dave/www/go/wikisync/web/node_modules/next/dist/server/next-server.js:381:9)\n' +
      '    at async Object.fn (/Users/dave/www/go/wikisync/web/node_modules/next/dist/server/base-server.js:497:37)',
    name: 'TypeError'
  },
  providerId: 'cognito',
  message: 'id_token not present in TokenSet'
}

My [...nextauth].ts has this in it

import NextAuth from "next-auth"
import Cognito from "next-auth/providers/cognito"
import { getApiConfig } from "src/api"

const config = getApiConfig()
export default NextAuth({
	providers: [
		Cognito({
			clientId: config.UserPoolClientID,
			clientSecret: config.UserPoolClientSecret,
			issuer: `https://cognito-idp.eu-west-2.amazonaws.com/${config.UserPoolID}`,
		}),
	],
	secret: config.UserPoolClientSecret,
	debug: process.env.NODE_ENV !== "production",
})

Many thanks for your hard work and time! 🙏

[ThangHuuVu]

Cognito is an OIDC provider, try adding the openid scope

export default NextAuth({
	providers: [
		Cognito({
			clientId: config.UserPoolClientID,
			clientSecret: config.UserPoolClientSecret,
			issuer: `https://cognito-idp.eu-west-2.amazonaws.com/${config.UserPoolID}`,
                        authorization:{
                          params:{
                            scope:"openid"
                          }
                        }

		}),
	],
	secret: config.UserPoolClientSecret,
	debug: process.env.NODE_ENV !== "production",
})

[davemackintosh]

I tried this and I still get the same error, I can see the id_token property in the account object on the callback response.

[davemackintosh]

Do you have any idea or do you want me to create a PR for this?