{"action":"created","issue":{"url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/165","labels_url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/165/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/165/comments","events_url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/165/events","html_url":"https://github.com/aws/aws-sdk-ios/issues/165","id":62883155,"number":165,"title":"forbidden identity","user":{"login":"donileo","id":1881038,"avatar_url":"https://avatars.githubusercontent.com/u/1881038?v=3","gravatar_id":"","url":"https://api.github.com/users/donileo","html_url":"https://github.com/donileo","followers_url":"https://api.github.com/users/donileo/followers","following_url":"https://api.github.com/users/donileo/following{/other_user}","gists_url":"https://api.github.com/users/donileo/gists{/gist_id}","starred_url":"https://api.github.com/users/donileo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donileo/subscriptions","organizations_url":"https://api.github.com/users/donileo/orgs","repos_url":"https://api.github.com/users/donileo/repos","events_url":"https://api.github.com/users/donileo/events{/privacy}","received_events_url":"https://api.github.com/users/donileo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aws/aws-sdk-ios/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-03-19T05:35:48Z","updated_at":"2015-04-01T02:12:55Z","closed_at":null,"body":"I've been investigating a super weird error that occurs when my app that was previously log'd in with Facebook then is deleted and reinstalled. When the app asks to register for push notifications Amazons SDK will give a User identity is forbidden. Here is the error:\r\n\r\n```\r\nAWSiOSSDKv2 [Verbose] AWSURLRequestSerialization.m line:110 | -[AWSJSONRequestSerializer serializeRequest:headers:parameters:] | Request body: [{\"IdentityId\":\"us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx\"}]\r\n2015-03-18 23:00:56.554 Rendxxxxxx[2135:1168595] AWSiOSSDKv2 [Debug] AWSURLResponseSerialization.m line:85 | -[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response header: [{\r\n    \"Content-Length\" = 129;\r\n    \"Content-Type\" = \"application/x-amz-json-1.1\";\r\n    Date = \"Thu, 19 Mar 2015 03:00:55 GMT\";\r\n    nnCoection = close;\r\n    \"x-amzn-RequestId\" = \"29c5be36-cde4-11e4-b63f-217feac9a8d2\";\r\n}]\r\n2015-03-18 23:00:56.554 Rendxxxxxx[2135:1168595] AWSiOSSDKv2 [Verbose] AWSURLResponseSerialization.m line:90 | -[AWSJSONResponseSerializer responseObjectForResponse:originalRequest:currentRequest:data:error:] | Response body: [{\"__type\":\"NotAuthorizedException\",\"message\":\"Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx' is forbidden.\"}]\r\n2015-03-18 23:00:56.557 Rendxxxxxx[2135:1168595] AWSiOSSDKv2 [Error] AWSIdentityProvider.m line:214 | __45-[AWSAbstractCognitoIdentityProvider refresh]_block_invoke_2 | GetOpenIdToken failed. Error is [Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=9 \"The operation couldn’t be completed. (com.amazonaws.AWSCognitoIdentityErrorDomain error 9.)\" UserInfo=0x17086ca00 {__type=NotAuthorizedException, message=Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx' is forbidden.}]\r\n2015-03-18 23:00:56.558 Rendxxxxxx[2135:1168595] AWSiOSSDKv2 [Error] AWSCredentialsProvider.m line:581 | __40-[AWSCognitoCredentialsProvider refresh]_block_invoke354 | Unable to refresh. Error is [Error Domain=com.amazonaws.AWSCognitoIdentityErrorDomain Code=9 \"The operation couldn’t be completed. (com.amazonaws.AWSCognitoIdentityErrorDomain error 9.)\" UserInfo=0x17086ca00 {__type=NotAuthorizedException, message=Access to Identity 'us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxx' is forbidden.}]\r\n```\r\n\r\nNow deep diving into amazons sdks i find a peculiar area of code that look a bit fishy to me:\r\n\r\nlines 405-412 of AWSCredentialsProvider.m\r\n\r\n```\r\n// If the identity provider has an identity id, use it\r\n        if (identityProvider.identityId) {\r\n            _keychain[AWSCredentialsProviderKeychainIdentityId] = identityProvider.identityId;\r\n        }\r\n        // Otherwise push whatever is in the keychain down to the identity provider\r\n        else {\r\n            identityProvider.identityId = _keychain[AWSCredentialsProviderKeychainIdentityId];\r\n        }\r\n```\r\n\r\nwhich states that if no identity_id is found.. use whatever was already in the keychain, but remember the keychain persists even if the app is deleted. So to better explain, if we logged in previously with Facebook the previous identity_id gets stored  in the keychain. Then when the app gets removed from the device and reinstalled the above code picks up the stored auth'ed identity_id from the keychain from before and uses it in our call to GetOpenTokenID. This seems bad because now any calls to AmazonAWS will try to access this authenticated_id which we can only access after the device gets a new token from Facebook authenticating with that previous login. If there is no Facebook token (if user doesn't do a Facebook login) this will result in an invalid request to GetOpenTokenID with the identity_id set to the auth_ed id from before but no logins dictionary.. which I believe is the error above. Hopefully I did proper analysis of this, if this is indeed a bug please fix asap!\r\n\r\nafter looking around a bit i also found this https://github.com/aws/aws-sdk-ios/issues/93.. in which you guys state its not reproducible. in my case it is very reproducible. Simply add aws-sdk/cognito. perform a login with Facebook, delete the app, reinstall the app then try to make a call to amazon sns for example to add push notifications for guests.\r\n\r\nAs a temporary solution executing the clearKeychain method on the AWSCredentials will fix the problem asap. but that would mean somehow being able to catch your app was reinstalled to run this method."},"comment":{"url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/comments/88314442","html_url":"https://github.com/aws/aws-sdk-ios/issues/165#issuecomment-88314442","issue_url":"https://api.github.com/repos/aws/aws-sdk-ios/issues/165","id":88314442,"user":{"login":"donileo","id":1881038,"avatar_url":"https://avatars.githubusercontent.com/u/1881038?v=3","gravatar_id":"","url":"https://api.github.com/users/donileo","html_url":"https://github.com/donileo","followers_url":"https://api.github.com/users/donileo/followers","following_url":"https://api.github.com/users/donileo/following{/other_user}","gists_url":"https://api.github.com/users/donileo/gists{/gist_id}","starred_url":"https://api.github.com/users/donileo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donileo/subscriptions","organizations_url":"https://api.github.com/users/donileo/orgs","repos_url":"https://api.github.com/users/donileo/repos","events_url":"https://api.github.com/users/donileo/events{/privacy}","received_events_url":"https://api.github.com/users/donileo/received_events","type":"User","site_admin":false},"created_at":"2015-04-01T02:12:55Z","updated_at":"2015-04-01T02:12:55Z","body":"That sounds like a good compromise. My initial suggestion to store the data on the document directory was based on the assumption that the data didn't need to be secured which is a bad assumption :), I mean why would you be using the keychain anyways.... But yes checking for a token on the app directory which then dictates whether to reuse the existing keychain identity or clear it and start a new one sounds like a possible solution. I think the initial issue is that somehow you guys believed the Keychain would be deleted upon an app deletion, I thought the same initially but nope unfortunately its not :). After a bit more thinking though, why not just store this cached token (not the keychain data) on AWS itself."}}