title: Google Authentication fails with AWS Cognito Identity Pool on Android
body: <p>I get an <code>NotAuthorizedException:Token is not from a supported provider of this identity pool</code> when I call <code>Amazon.CognitoIdentity.AmazonCognitoIdentityClient.GetIdAsync()</code></p>
  
  <p>I do not understand why, the token was obtained by authenticating with <code>GoogleSignInApi</code>, and the AWS Identity Pool is configured to federate to the Google authentication provider with the same "Google WebApp Client ID" used to authenticate on the Android device.</p>
  
  <p><a href="https://i.stack.imgur.com/WGAom.png" rel="noreferrer"><img src="https://i.stack.imgur.com/WGAom.png" alt="enter image description here"></a></p>
  
  <p>Also I've tried to obtain the Google token using 2 different ways</p>
  
  <ul>
  <li>using the result of <code>.RequestIdToken()</code> on the <code>GoogleSignInOptions</code></li>
  <li>by calling the <code>GoogleAuthUtil.GetToken</code> API</li>
  </ul>
  
  <p>Both tokens are different when inspected, both look like good tokens, and both fail with the same error when given to <code>AmazonCognitoIdentityClient</code>. Clearly the user is authenticated on the Android device, the app is able to get the Email, DisplayName etc...</p>
  
  <pre><code>var googleSignInOptions = new 
  GoogleSignInOptions.Builder(GoogleSignInOptions.DefaultSignIn)
     .RequestIdToken("Google WebApp Client ID")
     .RequestEmail()
     .Build();
  
  mGoogleApiClient = new GoogleApiClient.Builder(this)
     .EnableAutoManage(
        this, // FragmentActivity
        this) // OnConnectionFailedListener
     .AddApi(Auth.GOOGLE_SIGN_IN_API, gso)
     .Build();
  
  mGoogleApiClient.Connect();
  
  var result = await Auth.GoogleSignInApi.SilentSignIn(mGoogleApiClient);
  
  // Only need one or the other, trying to figure out which
  var idToken = result.SignInAccount.IdToken;
  var authToken = await GetGoogleAuthTokenAsync(result.SignInAccount.Email);
  
  var shortLivedAWScredentials = new CognitoAWSCredentials("identity-pool-id", AWSConfigs.RegionEndpoint);
  var cognitoClient = new AmazonCognitoIdentityClient(shortLivedAWScredentials,AWSConfigs.RegionEndpoint);
  
  var logins = new Dictionary&lt;string, string&gt;();
  logins["accounts.google.com"] = idToken; // same failure if I use authToken
  
  var request = new GetIdRequest();
  request.IdentityPoolId = "identity-pool-id";
  request.Logins = logins;
  
  var result = await cognitoClient.GetIdAsync(request); // THIS THROWS Amazon.CognitoIdentity.Model.NotAuthorizedException
  
  private async Task&lt;string&gt; GetGoogleAuthTokenAsync(string accountEmail)
  {
     Account googleAccount = new Account(accountEmail, GoogleAuthUtil.GoogleAccountType);
     string scopes = "audience:server:client_id:" + "Google WebApp Client ID"
     var token = await Task.Run(() =&gt; { return GoogleAuthUtil.GetToken(this, googleAccount, scopes); });
     return token;
  }
  </code></pre>
  
  <p><strong>Notes</strong>
  - Right after the exception, the AWS Console shows the Cognito identity pool grows by 1 unauthenticated identity, no change to the number of google identities <a href="https://i.stack.imgur.com/6gk6W.png" rel="noreferrer"><img src="https://i.stack.imgur.com/6gk6W.png" alt="enter image description here"></a></p>