AWS Cognito USER_PASSWORD_AUTH "Initiate Auth method not supported."

Question

I am trying to do the following:

  AWSUtil.generateSecretHash('[email protected]', ClientId).then(SECRET_HASH => {
    return AWSUtil.Cognito.adminInitiateAuth({
      AuthFlow: 'USER_PASSWORD_AUTH',
      ClientId,
      UserPoolId: process.env.COGNITO_USER_POOL_ID,
      AuthParameters: {
        USERNAME: '[email protected]',
        PASSWORD: 'lamepassword123',
        SECRET_HASH
      }
    }).promise();
  })
  .then(resp => {
    console.log(resp)
  });

It will not return anything but "Initiate Auth method not supported."

According to the docs, this should work. What gives?

Graeco

Answer 1

Under the App Clients section, did you enable the box for your user pool that says:

[x] Enable username-password (non-SRP) flow for app-based authentication (USER_PASSWORD_AUTH)

Freshwater

I have the same problem explained in the question. And I have that box you've mentioned checked and still getting the error. Any other suggestions? – Staciestack

Answer 2

I had the same issue - resolved it by using AuthFlow ADMIN_NO_SRP_AUTH rather than USER_PASSWORD_AUTH per the example here.

Bethesda

Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH) – Fatback

Answer 3

In case of Serverless framework usage, the ALLOW_USER_PASSWORD_AUTH need to be added to the ExplicitAuthFlows node.

Resources:
  CognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      # Generate a name based on the stage
      UserPoolName: ${self:provider.stage}-user-pool
      # Set email as an alias
      UsernameAttributes:
        - email
      AutoVerifiedAttributes:
        - email

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      # Generate an app client name based on the stage
      ClientName: ${self:provider.stage}-user-pool-client
      UserPoolId:
        Ref: CognitoUserPool
      ExplicitAuthFlows:
        - ALLOW_ADMIN_USER_PASSWORD_AUTH # See also: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.html
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_USER_SRP_AUTH
      GenerateSecret: false

# Print out the Id of the User Pool that is created
Outputs:
  UserPoolId:
    Value:
      Ref: CognitoUserPool

  UserPoolClientId:
    Value:
      Ref: CognitoUserPoolClient

Eyas

Answer 4

• Go to the Cognito Service

• Then, select the app client

• Finally, edit the authentication workflows

Hypermeter