[Authenticator] User is logged out automatically when App takes Authenticator 1.8.0 into use

[pmellaaho]

Before creating a new issue, please confirm:

• I have searched for duplicate or closed issues.
• I have read the guide for submitting bug reports.

Which UI component?

Authenticator

Gradle script dependencies

// Put output below this line
amplifyAuthenticator = "1.8.0"
amplifyCoreKotlin = "2.30.3"

Environment information

# Put output below this line
Gradle 8.13

Please include any relevant guides or documentation you're referencing

No response

Describe the bug

Once we updated our App's Amplify Authenticator dependency from 1.7.0 to 1.8.0 and re-launched the App, the signed-in user was not anymore signed-in and user was autoimatically taken to login screen. Even though the 1.8.0 includes passwordless sign in flows, we did not do any related code or Amplify conf. changes i.e. it was not our intention to enable passwordless sign in flows to App. If this is intended behaviour, please add some documentation.

Reproduction steps (if applicable)

1. Install App that used Amplify Authenticator 1.7.0
2. Sign-in user
3. Update the App with a new version that now depends on Amplify Authenticator 1.8.0
4. The user is not anymore signed-in state

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

Configuration File

No response

Additional information and screenshots

No response

[jvh-aws]

@pmellaaho thanks for reporting the issue! I followed the steps you provided but couldn't reproduce the issue. When updating amplify-ui-authenticator from 1.7.0 to 1.8.0, the session was persisted.

However, you reported using amplify-android on version 2.30.3, so I'm assuming that's the version of your amplify-auth-cognito. This version has a known issue, see this issue. In case your update also triggered an update from 2.30.3 to 2.30.4 (or similar), this could cause session loss. Can you please verify the version of amplify-auth-cognito and make sure it is 2.30.4+?

Also, please let us know in case you could provide any further guidance on reproducing the specific issue.

[pmellaaho]

Thanks for a fast reply! Our App uses these Amplify dependencies:

amplify-authenticator = { module = "com.amplifyframework.ui:authenticator", version.ref = "amplifyAuthenticator" } amplify-core-kotlin = { module = "com.amplifyframework:core-kotlin", version.ref = "amplifyCoreKotlin" }

Before an update we used these:
amplifyAuthenticator = "1.7.0" amplifyCoreKotlin = "2.29.2"

And then updated to:
amplifyAuthenticator = "1.8.0" amplifyCoreKotlin = "2.30.3"

As were not aware of any version matrix of supported combinations we have followed this kind of process: when updating Authenticator we have checked the version of aws-auth-cognito that authenticator depends on internally and used that version as amplifyCoreKotlin. Thanks for letting us know about the issue which explains what is going on. As for the future, what do you recommend us to do when we notice that there is new Authenticator version available that we would like to take into use?

[jvh-aws]

We will release an update of amplify-authenticator that bumps the dependency to the Amplify libraries. For use with amplify-authenticator, any more recent version of the Amplify libraries should work.

[jvh-aws]

We have documented the issue in #300 and released Authenticator v1.9.0 and Liveness v1.10.0, which depend on Amplify v2.33.0. Please let us know if this fixes the issue for you.

[pmellaaho]

Ok, did some testing and noticed that the upgrading problem is now fixed but there is another problem which was actually present with the configuration (amplifyAuthenticator = "1.8.0" amplifyCoreKotlin = "2.30.3") I tried before. If the user does password reset, they don't remain signed-in after successfull password reset:

Password reset complete Sending message: com.amplifyframework.ui.authenticator.util.PasswordResetMessage@5e13c7d Moving to step: com.amplifyframework.ui.authenticator.enums.AuthenticatorStep$SignIn@5fd31e0

[jvh-aws]

Thanks a lot for reporting this. I can reproduce the behavior that you describe with both Authenticator v1.8.0 and v1.9.0, while on v1.7.0 a password reset logs the user in. We will continue investigating this.