Login with google for the second time : email Attribute cannot be updated

[uchar]

Describe the bug
I have the same problem as this #issue. If you make a user pool with required email field then the second google login attempt fails.
changing required fields after creating UserPool is not possible and deleting the UserPool and making a new one doesn't look like a good solution to me because by doing it I will lose all my user's data!

To Reproduce

1. Make a new UserPool with email attribute as required field
2. Enable Google federation in UserPool
3. Try to login for the second time using hosted ui
4. It should give you this error: email Attribute cannot be updated.

Expected behavior
When we use same email address it shouldn't update email attribute!

[powerful23]

@uchar Hi, did you map the email attributes from google to the Cognito User Pool? There is an section Attribute mapping under Federation in the Cognito User Pool console that you can do the mapping.

[uchar]

@uchar Hi, did you map the email attributes from google to the Cognito User Pool? There is an section Attribute mapping under Federation in the Cognito User Pool console that you can do the mapping.

Yes I did, and It works fine for the first time but trying to sign in for the second time give me that error

[powerful23]

@uchar I tried to reproduce issue but couldn't. I have the email attribute as required in my user pool setting. Is your email attributes mutable? There is a Set attribute read and write permissions secton under App clients.

[jcharlesworthuk]

I'm experiencing a similar issue, same setup as @uchar but I'm getting "Exception processing authorization code" the second time I sign in.

In answer to your question @powerful23, the email is ticked as writable under App Clients. In fact for me there is a message there that says Required attributes are always writable

[adrian-brennan]

I can reproduce the same issue. email is not mandatory for my pool, and is selected as readable and writable by my app client. First time login succeeds (and the email attribute on my Cognito user is populated), subsequent logins fail with 'user+attributes%3A+email%3A+Attribute+cannot+be+updated' error.

I worked around it by creating a custom attribute called 'emailaddress' and mapped the Google email attribute to that.

[vladistan]

Got the same problem. I am not using amplify, just regular OIDC client library.

I get this error when using Google and SAML login through ADFS. Also doesn't matter if it's one of the standard attributes or a custom one. I tried to map 'name' attribute from google to customName, and now I am getting an error message saying 'customName' could not be updated

[sammartinez]

@uchar Are you still experiencing this issue with later versions of Amplify? Please let us know

[stale]

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.