How to process with AWS-cognito NEW_PASSWORD_REQUIRED Challenge

Question

When I use the below code:

$result = $this->client->adminInitiateAuth([
                'AuthFlow' => 'ADMIN_NO_SRP_AUTH',
                'ClientId' => $this->client_id,
                'UserPoolId' => $this->userpool_id,
                'AuthParameters' => [
                    'USERNAME' => $username,
                    'PASSWORD' => $password,
                ],
            ]);

I am getting a response with session and challengeName :NEW_PASSWORD_REQUIRED. From this how to generate the AccessToken in AWS-cognito?

D Malan · Answer 1 · 2019-03-20T16:56:39.090

8

You can use the respondToAuthChallenge method to set the user's new password and log them in. It should also return the accessToken for you.

You could do something like this:

$result = $this->client->respondToAuthChallenge([
            'ChallengeName' => 'NEW_PASSWORD_REQUIRED',
            'ClientId' => $this->client_id,
            'ChallengeResponses' => [
                'USERNAME' => $username,
                'NEW_PASSWORD' => $password,
            ],
            'Session' => $session,
        ]);

edited Mar 20 '19 at 16:56

answered Mar 20 '19 at 14:46

D Malan

10,272
3
25
50

Should we add session here – imlokeshs Mar 20 '19 at 16:40
@imlokeshs I'm not sure. The documentation says it isn't required, but you'll have to test and see whether it's necessary. – D Malan Mar 20 '19 at 16:41
Response is undefined for me. – imlokeshs Mar 20 '19 at 16:43
Does it throw any exceptions? – D Malan Mar 20 '19 at 16:47
1

Yes. It says Session need to be added. – imlokeshs Mar 20 '19 at 16:54
Cool, then just add it to the request array, e.g. `'Session' => $session,`. Updated my answer to include it too. – D Malan Mar 20 '19 at 16:56
so we have create our own UI for setting new password? – Shadab Faiz Apr 09 '21 at 06:52

score 0 · Answer 2 · answered Mar 21 '19 at 11:20

You need to respond this challenge (respondToAuthChallenge) using the session returned by adminInitiateAuth method. This session is a key to respond because the user at this time not is logged yet and is valid for 3 minutes. After that, you will reveive (if the session is valid) the RefreshToken, AccessToken and IdToken.

How to process with AWS-cognito NEW_PASSWORD_REQUIRED Challenge

2 Answers2