2

Requirement: Below code is having 2 functions. 1st verify the username and password of user and if it is true it trigger OTP in SMS(Default behavior of AWS as 2 factor authentication is enabled). But we do not want OTP in SMS. We want OTP in Email with custom template, so implemented 2nd function with AuthFlow: 'CUSTOM_AUTH'(and 2nd method works as expected). We do not want OTP to be triggered in SMS(But also can not disable 2 factor auth because it is used in other use cases). Also, only need solution using aws-sdk. There are ways using amplify and other library but it is not useful in case of App client secret is there.

//verify username,password and send code in sms
response0 = await cognitoIdentityServiceProvider.adminInitiateAuth({
    AuthFlow: 'ADMIN_NO_SRP_AUTH',
    ClientId: tenant.cognitoClientId,
    UserPoolId: tenant.cognitoUserPool,
    AuthParameters: {
        SECRET_HASH: crypto.createHmac('SHA256', tenant.cognitoClientSecret).update(username + tenant.cognitoClientId).digest('base64'),
        USERNAME: username,
        PASSWORD: password
    }
}).promise();


// send code to email using custom auth flow 
response1 = await cognitoIdentityServiceProvider.adminInitiateAuth({
    AuthFlow: 'CUSTOM_AUTH',
    ClientId: tenant.cognitoClientId,
    UserPoolId: tenant.cognitoUserPool,
    AuthParameters: {
        SECRET_HASH: crypto.createHmac('SHA256', tenant.cognitoClientSecret).update(username + tenant.cognitoClientId).digest('base64'),
        USERNAME: username,
        PASSWORD: tenantId + secrets.PASSWORD_SECRET
    }
}).promise();

Need solution where we can check username password using AuthFlow: 'CUSTOM_AUTH'(Can change lambda triggers) or any other way where OTP should not be triggered and able to check username and password correctly.

Chintan Patel
  • 29
  • 3
  • Ahh crap, you've explained my same exact scenario and problem with no answer yet. All I can find on the net are docs saying you can use SRP to verify password in a CUSTOM_AUTH Flow if you make that the first challenge... I'm not sure if this person was actually able to do it without SRP: https://stackoverflow.com/questions/54254443/aws-cognito-custom-auth-flow-with-user-password-auth – ganta Feb 14 '23 at 22:41

0 Answers0