How to process with AWS-cognito NEW_PASSWORD_REQUIRED Challenge

Question

When I use the below code:

$result = $this->client->adminInitiateAuth([
                'AuthFlow' => 'ADMIN_NO_SRP_AUTH',
                'ClientId' => $this->client_id,
                'UserPoolId' => $this->userpool_id,
                'AuthParameters' => [
                    'USERNAME' => $username,
                    'PASSWORD' => $password,
                ],
            ]);

I am getting a response with session and challengeName :NEW_PASSWORD_REQUIRED. From this how to generate the AccessToken in AWS-cognito?

Nephew

Answer 1

You can use the respondToAuthChallenge method to set the user's new password and log them in. It should also return the accessToken for you.

You could do something like this:

$result = $this->client->respondToAuthChallenge([
            'ChallengeName' => 'NEW_PASSWORD_REQUIRED',
            'ClientId' => $this->client_id,
            'ChallengeResponses' => [
                'USERNAME' => $username,
                'NEW_PASSWORD' => $password,
            ],
            'Session' => $session,
        ]);

Youngs

Should we add session here – Nephew

@Nephew I'm not sure. The documentation says it isn't required, but you'll have to test and see whether it's necessary. – Youngs

Response is undefined for me. – Nephew

Does it throw any exceptions? – Youngs

Yes. It says Session need to be added. – Nephew

Cool, then just add it to the request array, e.g. 'Session' => $session,. Updated my answer to include it too. – Youngs

so we have create our own UI for setting new password? – Crist

Answer 2

You need to respond this challenge (respondToAuthChallenge) using the session returned by adminInitiateAuth method. This session is a key to respond because the user at this time not is logged yet and is valid for 3 minutes. After that, you will reveive (if the session is valid) the RefreshToken, AccessToken and IdToken.

Ratafia