AWSCognitoCredentialsProvider Class Reference

Inherits from NSObject
Conforms to AWSCredentialsProvider
Declared in AWSCredentialsProvider.h
AWSCredentialsProvider.m

Overview

An AWSCredentialsProvider that uses Amazon Cognito to fetch temporary credentials tied to an identity.

To learn more about Amazon Cognito, please visit https://aws.amazon.com/cognito.

There are 3 different flows supported by this credentials provider, see factory and init methods for choosing the right one for your use case:

  1. Enhanced flow: Uses Cognito for all operations and only requires an identity pool id to initialize.
  2. Basic flow: Uses Cognito + STS and requires identity pool plus IAM roles
  3. Developer authenticated identities: Uses your own AWSCognitoCredentialsProviderHelper to establish identity + Cognito (and optionally STS) to establish credentials.

Other Methods

– initWithRegionType:identityPoolId:

Initializer for credentials provider with enhanced authentication flow. This is the recommended constructor for first time Amazon Cognito developers. Will create an instance of AWSEnhancedCognitoIdentityProvider.

- (instancetype)initWithRegionType:(AWSRegionType)regionType identityPoolId:(NSString *)identityPoolId

Parameters

regionType

The region in which your identity pool exists.
identityPoolId

The identity pool id for this provider. Value is used to communicate with Amazon Cognito as well as namespace values stored in the keychain.

Declared In

AWSCredentialsProvider.h

– initWithRegionType:identityPoolId:identityProviderManager:

Initializer for credentials provider with enhanced authentication flow. This is the recommended method for first time Amazon Cognito developers. Will create an instance of AWSEnhancedCognitoIdentityProvider.

- (instancetype)initWithRegionType:(AWSRegionType)regionType identityPoolId:(NSString *)identityPoolId identityProviderManager:(nullable id<AWSIdentityProviderManager>)identityProviderManager

Parameters

regionType

The region in which your identity pool exists.
identityPoolId

The identity pool id for this provider. Value is used to communicate with Amazon Cognito as well as namespace values stored in the keychain.
identityProviderManager

An object that conforms to the AWSIdentityProviderManager protocol. It should return a valid login dictionary when requested. Can be nil if identity is unauthenticated.

Declared In

AWSCredentialsProvider.h

– initWithRegionType:identityProvider:

Initializer for credentials provider with pre-created AWSCognitoCredentialsProviderHelper. Use this method when using developer authenticated identities.

- (instancetype)initWithRegionType:(AWSRegionType)regionType identityProvider:(id<AWSCognitoCredentialsProviderHelper>)identityProvider

Parameters

regionType

The region in which your identity pool exists.
identityProvider

Implementation of AWSCognitoCredentialsProviderHelper which is responsible for acquiring identity id and (optionally) OpenId Connect token.

Declared In

AWSCredentialsProvider.h

– initWithRegionType:unauthRoleArn:authRoleArn:identityProvider:

Initializer for credentials provider with pre-created AWSCognitoCredentialsProviderHelper. Only use this method if you need to set your IAM roles client side and use developer authenticated identities

- (instancetype)initWithRegionType:(AWSRegionType)regionType unauthRoleArn:(NSString *)unauthRoleArn authRoleArn:(NSString *)authRoleArn identityProvider:(id<AWSCognitoCredentialsProviderHelper>)identityProvider

Parameters

regionType

The region in which your identity pool exists.
unauthRoleArn

The role ARN to use when getting credentials for unauthenticated identities. Provider will check the isAuthenticated property of the identity provider to determine which role to use. Can be nil if unauthenticated identities are not supported or if using enhanced authentication flow.
authRoleArn

The role ARN to use when getting credentials for authenticated identities. Provider will check the isAuthenticated property of the identity provider to determine which role to use. Can be nil if authenticated identities are not supported or if using enhanced authentication flow.
identityProvider

Implementation of AWSCognitoCredentialsProviderHelper which is responsible for acquiring identity id and (optionally) OpenId Connect token.

Declared In

AWSCredentialsProvider.h

– initWithRegionType:identityPoolId:unauthRoleArn:authRoleArn:identityProviderManager:

Initializer for credentials provider with basic auth flow. Only use this method if you still need to set your IAM roles client side. This method will create an instance of AWSBasicCognitoIdentityProvider.

- (instancetype)initWithRegionType:(AWSRegionType)regionType identityPoolId:(NSString *)identityPoolId unauthRoleArn:(nullable NSString *)unauthRoleArn authRoleArn:(nullable NSString *)authRoleArn identityProviderManager:(nullable id<AWSIdentityProviderManager>)identityProviderManager

Parameters

regionType

The region in which your identity pool exists.
identityPoolId

The identity pool id for this provider. Value is used to communicate with Amazon Cognito as well as namespace values stored in the keychain.
unauthRoleArn

The role ARN to use when getting credentials for unauthenticated identities. Provider will check the isAuthenticated property of the identity provider to determine which role to use. Can be nil if unauthenticated identities are not supported.
authRoleArn

The role ARN to use when getting credentials for authenticated identities. Provider will check the isAuthenticated property of the identity provider to determine which role to use. Can be nil if authenticated identities are not supported.
identityProviderManager

An object that conforms to the AWSIdentityProviderManager protocol. It should return a valid login dictionary when requested. Can be nil if identity is unauthenticated.

Declared In

AWSCredentialsProvider.h

– credentials

Asynchronously returns a valid AWS credentials or an error object if it cannot retrieve valid credentials. It should cache valid credentials as much as possible and refresh them when they are invalid.

- (AWSTask<AWSCredentials*> *)credentials

Return Value

A valid AWS credentials or an error object describing the error.

Declared In

AWSCredentialsProvider.h

– invalidateCachedTemporaryCredentials

Invalidates the cached temporary AWS credentials. If the credentials provider does not cache temporary credentials, this operation is a no-op.

- (void)invalidateCachedTemporaryCredentials

Declared In

AWSCredentialsProvider.h

– getIdentityId

Get/retrieve the identity id for this provider. If an identity id is already set on this provider, no remote call is made and the identity will be returned as a result of the AWSTask (the identityId is also available as a property). If no identityId is set on this provider, one will be retrieved from the service.

- (AWSTask<NSString*> *)getIdentityId

Return Value

AWSTask

Declared In

AWSCredentialsProvider.h

– clearKeychain

Clear ALL saved values for this provider (identityId, credentials, logins).

- (void)clearKeychain

Declared In

AWSCredentialsProvider.h

– clearCredentials

Clear the cached AWS credentials for this provider.

- (void)clearCredentials

Declared In

AWSCredentialsProvider.h

– identityPoolId

The identity pool id associated with this provider. Also used to create a namedspaced keychain area to store identity id and credentials.

- (NSString *)identityPoolId

Declared In

AWSCredentialsProvider.h

– identityId

The identity id associated with this provider. This value will be fetched from the keychain at startup. If you do not want to reuse the existing identity id, you must call the clearKeychain method.

- (NSString *)identityId

Declared In

AWSCredentialsProvider.h

Other Methods

  identityProvider

The identityProvider which is responsible for establishing the identity id and (optionally) the open id token for use in the Amazon Cognito authflow.

@property (nonatomic, strong, readonly) id<AWSCognitoCredentialsProviderHelper> identityProvider

Declared In

AWSCredentialsProvider.h