Firebase谷歌登录后通过AWS Cognito获取临时令牌报错求助

背景 #

我是AWS新手，表述不当之处请见谅。我正在开发Ionic React前端项目，用户通过Firebase以Google作为身份提供商完成登录后，需要获取AWS临时令牌来访问AWS服务。我使用AWS Cognito联合身份池实现该功能，创建身份池时已将Google添加为Authenticated identity sources，但目前遇到验证错误。

错误信息 #

NotAuthorizedException: Invalid login token. Issuer doesn't match providerName

客户端获取的Access Token #

eyJhbGciOiJSUzI1NiIsImtpZCI6ImYwOGU2ZTNmNzg4ZDYwMTk0MDA1ZGJiYzE5NDc0YmY5Mjg5ZDM5ZWEiLCJ0eXAiOiJKV1QifQ.eyJuYW1lIjoiUGxlYXNlIElnbm9yZSIsInBpY3R1cmUiOiJodHRwczovL2xoMy5nb29nbGV1c2VyY29udGVudC5jb20vYS9BQ2c4b2NKU0ItZFNBS0loY2VGc2Z1OXdlUTgzWVdKZC12aUp6a0tHNDVKTEJPNTNlZVNYVEpRPXM5Ni1jIiwiaXNzIjoiaHR0cHM6Ly9zZWN1cmV0b2tlbi5nb29nbGUuY29tL2lieXRlc3QwMSIsImF1ZCI6ImlieXRlc3QwMSIsImF1dGhfdGltZSI6MTcxOTU5Mzg4MiwidXNlcl9pZCI6InIySVlFUFJPWnNhZDB5ZERQT0prN0ZyVW50ajEiLCJzdWIiOiJyMklZRVBST1pzYWQweWREUE9KazdGclVudGoxIiwiaWF0IjoxNzE5NTkzOTEwLCJleHAiOjE3MTk1OTc1MTAsImVtYWlsIjoieW95bzI5MjA2QGdtYWlsLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJmaXJlYmFzZSI6eyJpZGVudGl0aWVzIjp7Imdvb2dsZS5jb20iOlsiMTEyNjIxOTY4ODI3MTYzMTA2MzU2Il0sImVtYWlsIjpbInlveW8yOTIwNkBnbWFpbC5jb20iXX0sInNpZ25faW5fcHJvdmlkZXIiOiJnb29nbGUuY29tIn19.OxrJvKCGi_cEuKjJEUhCwHqLx13Wq2lmKxqC1vvmORhhcPBnknukLVbjNpzjkozfow6j0zKtx07ydD1RRdD79dJ113DDtJeJjsrdKAACfe8m40ymF7Ytlk-oMHI-dltnkSIg6Gv3ZTcYmCTkAe5e6d86T49aSIysoYKRNjrl72L-UjufW_Ozf7lTXOd6d5i4uNdEvcBCui78IY8CpQ3LTKgtSteR1xtEH0hP1TlFJwdrC3u0bY0j2sj2PZYYFlOpeVK3IzEgIIfx6GjXyx77aFHFJtSPiBxXcC1qyUncysIj9ZeNIM4Qc2431OOhpg7-3VkH5p8Lmz0U324I5QAxWQ

后端相关代码（Node.js Express） #

const AWS = require("aws-sdk");

AWS.config.update({
  region: "ap-southeast-2",
  accessKeyId: process.env.accessKeyId,
  secretAccessKey: process.env.secretAccessKey,
});

const { idToken } = req.body;

const params = {
  IdentityPoolId: "ap-southeast-2:xxxx-xxxx-xxxx-xxxx-xxxx",
  Logins: {
    "accounts.google.com": idToken,
  },
};

await new Promise((resolve, reject) => {
  AWS.config.region = "ap-southeast-2";
  AWS.config.credentials = new AWS.CognitoIdentityCredentials(params);

  AWS.config.credentials.refresh((err) => {
    if (err) {
      console.log("err", err);
      reject(err);
    } else {
      console.log("credentials", AWS.config.credentials);
      resolve(AWS.config.credentials);
    }
  });
});

res.json({
  AccessKeyId: credentials.accessKeyId,
  SecretAccessKey: credentials.secretAccessKey,
  SessionToken: credentials.sessionToken,
  Expiration: credentials.expiration,
});

请求帮助 #

恳请各位帮忙解决该问题，或提出相关排查方向，非常感谢😢😢

内容的提问来源于stack exchange，提问作者SaiRev