Connecting to AWS Cognito

[Christian A.]

I am trying to modify the https_client example from ncs\nrf\samples\nrf9160\https_client on Thingy91 so that it will retrieve an authentifcation token from AWS Cognito.
So far I have changed the certificate to Amazon Root CA 1, changed the URL to "cognito-idp.eu-central-1.amazonaws.com" instead of "google.com" and sending the following data to the server (sensitive data blanked here) instead of HTTP_HEAD as in the example:
    "POST / HTTP/1.1\r\n" \
    "Host: cognito-idp.eu-central-1.amazonaws.com\r\n" \
    "Content-Type: application/x-amz-json-1.1\r\n" \
    "X-Amz-Target: AWSCognitoIdentityProviderService.InitiateAuth\r\n" \
    "Content-Length: 149\r\n" \
    "\r\n" \
    "{\"AuthParameters\": {\"USERNAME\": \"xxxxxxxxx\", \"PASSWORD\": \"xxxxxxxxxxxx\"}, \"AuthFlow\": \"USER_PASSWORD_AUTH\", \"ClientId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxx\"}"

When I send this payload to AWS cognito using openssl s_client on a PC, I get the authentification token, but running on Thingy I just receive an empty reply from the server (zero bytes received, further reads produce an error: -1).
I substituted the certificate for the old one which is not in the verification chain of the cognito server and already the connect command fails, so I can rule out that the certificate is wrong.
I changed Content-Length to a value less than 149 and then I get a BAD REQUEST reply. If I change to something larger than 149, recv will block (which is to be expected as the server is still waiting for the missing payload).
I also tried to wait 2s between send and recv, but I still got an empty response from the server.
Any ideas what to do?

[Christian A.]

Firmware is

mfw_nrf9160_1.2.0

I tried it with SDK v1.2.0, but the behaviour is the same as with v1.3.0-rc1.

I also made an attempt with wrong credentials. The Cognito server answered with a BAD REQUEST reply (as expected) which was received by the application (383 bytes). I tried also to expand the receive buffer beyond the expected total size of an answer to a correct authentication (3995 bytes expected, buffer size set to 4096), but I still receive zero bytes.

[Christian A.]

I think I have found the root cause of the problem. I have setup an own SSL server and found that the modem will close the connection and recv returns 0 bytes, if a block of data exceeds 2315 bytes (plaintext). The size limit may depend rather on the size of the actual transmitted data, so permitted length of plaintext may depend on selected cipher suite (in my case it was ECDH-RSA-AES256-SHA). The responses of AWS Cognito are clearly beyond this limit (3995 bytes of plaintext), so I think we will have to abandon AWS Cognito (I assume that the limit is due to the modem's hardware)

[Øyvind]

Christian A. said:

I assume that the limit is due to the modem's hardware

Yes, it looks this is the issue I mentioned in my first response: 

Øyvind said:

The reason for this is that the nRF9160 only has 2k of RAM for certificates,