No MFA Challenge anymore ??? #6138

mpgo13 · 2020-06-22T20:10:25Z

Hi,

We are facing all of a sudden an issue with Cognito not asking it's users for MFA Challenge anymore.

We haven't changed anything related on our site.
Tested with different Browsers and IP's

Would you be able to look into this?

Have a look at these requests in eu-central-1 region:

date: Mon, 22 Jun 2020 19:46:18 GMT
x-amzn-requestid: 84d8f97b-3704-4c95-bc28-dfc69d9471fa
x-amzn-requestid: 4195fbe0-53f4-448a-b284-6bc57765966d
x-amzn-requestid: e252bc4d-fe76-409e-a366-20022e9a68cc

elorzafe · 2020-06-23T00:43:31Z

@mpgo13 What is the MFA configuration on the userpool? If is optional the user can disable.

mpgo13 · 2020-06-23T00:47:59Z

@elorzafe userpool is configured with optional MFA, but users have setup MFA and they used to get MFA challenge before.

Here one user (output of admin-get-user):

{
    "Username": "xxx",
    "UserAttributes": [
        {
            "Name": "sub",
            "Value": "xxx"
        },
        {
            "Name": "email_verified",
            "Value": "true"
        },
        {
            "Name": "name",
            "Value": "xxx"
        },
        {
            "Name": "phone_number_verified",
            "Value": "true"
        },
        {
            "Name": "phone_number",
            "Value": "xxx"
        },
        {
            "Name": "email",
            "Value": "xxx"
        }
    ],
    "UserCreateDate": "2020-05-08T05:24:50.856000+00:00",
    "UserLastModifiedDate": "2020-05-28T05:40:16.931000+00:00",
    "Enabled": true,
    "UserStatus": "CONFIRMED",
    "PreferredMfaSetting": "SOFTWARE_TOKEN_MFA",
    "UserMFASettingList": [
        "SOFTWARE_TOKEN_MFA"
    ]
}

sammartinez · 2020-06-24T15:38:33Z

@mpgo13 Are you using Amplify with your Amazon Cognito service?

mpgo13 · 2020-06-24T19:36:25Z

I’m using amplify-js in frontend. The issue seems to be happening only with my existing user pool, whereas it works with a new user pool.

…

On Thu, 25 Jun 2020 at 1:38 am, Sam Martinez ***@***.***> wrote: @mpgo13 <https://github.com/mpgo13> Are you using Amplify with your Amazon Cognito service? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6138 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIHKOG6JEWCPRYDYRIBL7DRYIMYTANCNFSM4OE75J6A> .

elorzafe · 2020-06-26T20:29:34Z

@mpgo13 could be a chance Time-based One-time Password setting on the User Pool to be disabled?

mpgo13 · 2020-06-26T21:02:12Z

@elorzafe both TOTP and SMS are checked in AWS console.

here is my userpool config output from aws cognito-idp describe-user-pool:

{
    "UserPool": {
        "Id": "USER-POOL-ID",
        "Name": "USER-POOL-NAME",
        "Policies": {
            "PasswordPolicy": {
                "MinimumLength": 8,
                "RequireUppercase": true,
                "RequireLowercase": true,
                "RequireNumbers": true,
                "RequireSymbols": false,
                "TemporaryPasswordValidityDays": 14
            }
        },
        "LambdaConfig": {},
        "LastModifiedDate": "2020-06-23T01:16:43.138000+00:00",
        "CreationDate": "2020-05-05T01:06:07.868000+00:00",
        "SchemaAttributes": [
            {
                "Name": "sub",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": false,
                "Required": true,
                "StringAttributeConstraints": {
                    "MinLength": "1",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "given_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "family_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "middle_name",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "nickname",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "preferred_username",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "profile",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "picture",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "website",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "email",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "email_verified",
                "AttributeDataType": "Boolean",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false
            },
            {
                "Name": "gender",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "birthdate",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "10",
                    "MaxLength": "10"
                }
            },
            {
                "Name": "zoneinfo",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "locale",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "phone_number",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "phone_number_verified",
                "AttributeDataType": "Boolean",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false
            },
            {
                "Name": "address",
                "AttributeDataType": "String",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "StringAttributeConstraints": {
                    "MinLength": "0",
                    "MaxLength": "2048"
                }
            },
            {
                "Name": "updated_at",
                "AttributeDataType": "Number",
                "DeveloperOnlyAttribute": false,
                "Mutable": true,
                "Required": false,
                "NumberAttributeConstraints": {
                    "MinValue": "0"
                }
            }
        ],
        "UsernameAttributes": [
            "email"
        ],
        "VerificationMessageTemplate": {
            "DefaultEmailOption": "CONFIRM_WITH_CODE"
        },
        "MfaConfiguration": "OPTIONAL",
        "EstimatedNumberOfUsers": 25,
        "EmailConfiguration": {
            "SourceArn": "ARN-EMAIL-CONFIG",
            "EmailSendingAccount": "DEVELOPER",
            "From": "FROM-EMAIL"
        },
        "SmsConfiguration": {
            "SnsCallerArn": "ARN-SMS-CONFIG",
            "ExternalId": "EXTERNAL-ID"
        },
        "UserPoolTags": {},
        "AdminCreateUserConfig": {
            "AllowAdminCreateUserOnly": true,
            "UnusedAccountValidityDays": 14
        },
        "UserPoolAddOns": {
            "AdvancedSecurityMode": "OFF"
        },
        "UsernameConfiguration": {
            "CaseSensitive": true
        },
        "Arn": "USER-POOL-ARN",
        "AccountRecoverySetting": {
            "RecoveryMechanisms": [
                {
                    "Priority": 1,
                    "Name": "admin_only"
                }
            ]
        }
    }
}

stale · 2020-07-26T22:00:56Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

mpgo13 · 2020-07-26T22:16:35Z

the issue is still present with that specific user pool created via cloudformation.

…

On Mon, 27 Jul 2020 at 8:01 am, stale[bot] ***@***.***> wrote: This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6138 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIHKOF6MHFEZ7YC6XPFGE3R5SRSJANCNFSM4OE75J6A> .

ericclemmons · 2020-08-12T21:06:38Z

@mpgo13 You mentioned it works with a new user pool but fails for the existing user pool? Just to confirm, have the spending limits been increased for Amazon SNS? (#6344 had similar issues)

mpgo13 · 2020-08-13T00:23:00Z

@ericclemmons SNS spending limits have been increased before this issue happened.

We only intend using SOFTWARE_TOKEN_MFA, is there any requirement to have SNS properly configured on the user pool to use SOFTWARE_TOKEN_MFA without actually using any SMS features ?

mpgo13 · 2020-08-17T06:46:46Z

What I noticed today:

Logging in with one of the users who had definately activated MFA, didn't get MFA challenge
After setting a new MFA device (using set-preferred-mfa-settings from API), the user finally got his MFA challenge again

stale · 2020-09-19T19:07:39Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale · 2020-09-28T04:30:27Z

This issue has been automatically closed because of inactivity. Please open a new issue if are still encountering problems.

github-actions · 2021-09-29T01:46:50Z

This issue has been automatically locked since there hasn't been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.

mpgo13 added the to-be-reproduced Used in order for Amplify to reproduce said issue label Jun 22, 2020

elorzafe added Cognito Related to cognito issues Service Team Issues asked to the Service Team pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. labels Jun 23, 2020

stale bot removed the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Jun 23, 2020

sammartinez removed the to-be-reproduced Used in order for Amplify to reproduce said issue label Jun 23, 2020

sammartinez added the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Jun 24, 2020

stale bot removed the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Jun 26, 2020

stale bot added the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Jul 26, 2020

stale bot removed the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Jul 26, 2020

stale bot added the pending-close-response-required A response is required for this issue to remain open, it will be closed within the next 7 days. label Sep 19, 2020

stale bot closed this as completed Sep 28, 2020

github-actions bot locked as resolved and limited conversation to collaborators Sep 29, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

No MFA Challenge anymore ??? #6138

No MFA Challenge anymore ??? #6138

mpgo13 commented Jun 22, 2020

elorzafe commented Jun 23, 2020

mpgo13 commented Jun 23, 2020 •

edited

sammartinez commented Jun 24, 2020

mpgo13 commented Jun 24, 2020 via email

elorzafe commented Jun 26, 2020

mpgo13 commented Jun 26, 2020

stale bot commented Jul 26, 2020

mpgo13 commented Jul 26, 2020 via email

ericclemmons commented Aug 12, 2020

mpgo13 commented Aug 13, 2020

mpgo13 commented Aug 17, 2020

stale bot commented Sep 19, 2020

stale bot commented Sep 28, 2020

github-actions bot commented Sep 29, 2021

No MFA Challenge anymore ??? #6138

No MFA Challenge anymore ??? #6138

Comments

mpgo13 commented Jun 22, 2020

elorzafe commented Jun 23, 2020

mpgo13 commented Jun 23, 2020 • edited

sammartinez commented Jun 24, 2020

mpgo13 commented Jun 24, 2020 via email

elorzafe commented Jun 26, 2020

mpgo13 commented Jun 26, 2020

stale bot commented Jul 26, 2020

mpgo13 commented Jul 26, 2020 via email

ericclemmons commented Aug 12, 2020

mpgo13 commented Aug 13, 2020

mpgo13 commented Aug 17, 2020

stale bot commented Sep 19, 2020

stale bot commented Sep 28, 2020

github-actions bot commented Sep 29, 2021

mpgo13 commented Jun 23, 2020 •

edited