3

I have a user pool where in want to use custom challenges along with TOTP MFA for authentication. I check if a user has TOTP setup or not in DefineAuthChallenge just after PASSWORD_VERIFIER challenge is complete. If not setup, I set next challengeName as "MFA_SETUP" with a session instead of issuing tokens. But when i try to hit aws cognito-idp associate-software-token --session <<session from password-verifier challenge>> it gives me the following error:
An error occurred (NotAuthorizedException) when calling the AssociateSoftwareToken operation: Invalid session for the user.
even though that session is a valid one.

When i try the same thing using access_token it does not give me any issues. Also when MFA mode for user pool is ON(mandatory), the session from PASSWORD_VERIFIER challenge can be used to setup MFA via associate-software-token.

Observed differences in MFA ON vs OPTIONAL setup: For ON, following challenge is automatically issued after PASSWORD_VERIFIER ignoring the CUSTOM_AUTH triggers, and following response is obtained:

{
    "ChallengeName": "MFA_SETUP",
    "Session": "<<session>>",
    "ChallengeParameters": {
        "MFAS_CAN_SETUP": "[\"SOFTWARE_TOKEN_MFA\"]"
    }
}

For OPTIONAL, my custom challenge's DefineAuthChallenge trigger is hit is issued after PASSWORD_VERIFIER which sets next challenge as MFA_SETUP, and following response is obtained:

{
    "ChallengeName": "MFA_SETUP",
    "ChallengeParameters": {},
    "Session": "<<session>>",
}

I am not sure if I am doing anything wrong in the custom flow. Is there any way I can force users to setup totp on first login through such custom challenge?

mihawk26
  • 33
  • 6
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. – Community Feb 27 '22 at 12:34
  • 1
    Hi @mihawk26 Have you got any idea how to force MFA_SETUP challenge in Cognito ? – Asish AP Apr 25 '22 at 12:13
  • As per Aws team, in custom auth challenge that is not possible. But if u are not using custom auth challenge, only way is to set Mfa to REQUIRED for the userpool. – mihawk26 Apr 26 '22 at 13:11

0 Answers0