AWS Cognito令牌适配Firebase signInWithCustomToken失败优化

Great question! Let's break this down clearly:

First, the root cause of your error: Firebase's custom tokens have non-negotiable requirements that Cognito's ID/access tokens don't satisfy. Even though both are valid JWTs, Firebase only accepts custom tokens signed with your Firebase project's service account private key and containing specific claims (like sub mapped to a Firebase user UID, plus standard JWT claims such as iat and exp). Cognito tokens are signed with your user pool's own keys, so Firebase rejects them immediately—no matter what claims they contain.

Short Answer: No, you can't use Cognito's PreTokenGeneration trigger for this #

The PreTokenGeneration trigger only lets you add or modify custom claims in Cognito tokens. It cannot change the token's signing key, algorithm, or core header structure—all of which Firebase checks during validation. Even if you tweak the claims to match Firebase's expectations, the signature will still come from Cognito, not your Firebase service account, so you'll get the same FirebaseAuthInvalidCredentialsException.

Better Alternatives (Avoid Maintaining Two Tokens) #

1. Backend Token Conversion (Best for Existing Cognito Flows) #

Add a lightweight backend step (like an AWS Lambda function) that bridges Cognito and Firebase without forcing you to manage two token systems:

• Your frontend sends a valid Cognito ID token to the backend after login
• The backend validates the Cognito token (verifies signature, expiration, and user identity via Cognito APIs)
• It uses the Firebase Admin SDK to generate a custom token for the corresponding Firebase user (creating the user in Firebase if they don't exist yet)
• Returns the Firebase custom token to your frontend for use with signInWithCustomToken

Here's a simplified Java example for the Lambda function:

import com.amazonaws.services.cognitoidp.AWSCognitoIdentityProvider;
import com.amazonaws.services.cognitoidp.AWSCognitoIdentityProviderClientBuilder;
import com.amazonaws.services.cognitoidp.model.GetUserRequest;
import com.amazonaws.services.cognitoidp.model.GetUserResult;
import com.google.firebase.auth.FirebaseAuth;
import com.google.firebase.auth.FirebaseAuthException;
import com.google.firebase.auth.UserCreateRequest;
import com.google.firebase.auth.UserRecord;

public class TokenConverterLambda {
    public String handleRequest(String cognitoIdToken, Context context) {
        // Step 1: Validate Cognito token and fetch user details
        AWSCognitoIdentityProvider cognitoClient = AWSCognitoIdentityProviderClientBuilder.defaultClient();
        GetUserRequest getUserRequest = new GetUserRequest().withAccessToken(cognitoIdToken);
        GetUserResult userResult = cognitoClient.getUser(getUserRequest);
        String cognitoUserId = userResult.getUsername();
        String userEmail = userResult.getEmail();

        // Step 2: Ensure user exists in Firebase (create if missing)
        FirebaseAuth firebaseAuth = FirebaseAuth.getInstance();
        UserRecord firebaseUser;
        try {
            firebaseUser = firebaseAuth.getUserByEmail(userEmail);
        } catch (FirebaseAuthException e) {
            if (e.getErrorCode().equals("user-not-found")) {
                UserCreateRequest createRequest = new UserCreateRequest()
                    .setEmail(userEmail)
                    .setUid(cognitoUserId); // Align Firebase UID with Cognito user ID for consistency
                firebaseUser = firebaseAuth.createUser(createRequest);
            } else {
                throw new RuntimeException("Failed to fetch or create Firebase user", e);
            }
        }

        // Step 3: Generate and return Firebase custom token
        try {
            return firebaseAuth.createCustomToken(firebaseUser.getUid());
        } catch (FirebaseAuthException e) {
            throw new RuntimeException("Failed to generate Firebase custom token", e);
        }
    }
}

Your frontend only needs to handle one token exchange flow, and the backend manages the conversion behind the scenes.

2. Integrate Cognito as an OIDC Provider in Firebase #

For a cleaner, code-light approach, set up Cognito as an OpenID Connect (OIDC) identity provider directly in Firebase:

• In the Firebase Console, go to Authentication > Sign-in method and add a new OIDC provider
• Enter your Cognito user pool's OIDC details (authorization endpoint, token endpoint, user info endpoint, and public key URL—find these in your Cognito user pool's App Integration settings)
• Configure the client ID and secret from your Cognito app client

Once set up, your frontend can use Firebase's signInWithRedirect or signInWithPopup methods to let users log in via Cognito directly. Firebase handles the token exchange automatically, and you'll get valid Firebase tokens without any custom backend code.

Wrap-Up #

While PreTokenGeneration can't modify Cognito tokens to work with Firebase's custom token system, these two alternatives let you integrate the services without maintaining separate token systems. The backend conversion is ideal for existing Cognito flows, while OIDC integration is better for new projects looking for a seamless login experience.

内容的提问来源于stack exchange，提问作者ronginat