我正在尝试实现基于以下内容的身份验证Cognito
使用他们的GoSDK
。我已经能够获得基本的username/password
身份验证可以工作,但是当我使用添加两因素身份验证时SMS
我被卡住了。
重现步骤 :
- 我使用用户名/密码和电子邮件验证创建用户
- 我验证电子邮件地址
- 我设置了电话号码并请求验证码
- 我验证电话号码
- 我启用了两步验证(通过短信)
- 我尝试登录并接收 SMS_MFA 质询
- 我在手机上收到代码并致电 AdminRespondToAuthChallenge
问题,我收到一个error
:
CodeMismatchException: Invalid code or auth state for the user.
status code: 400, request id: 1513894e-8efa-11e8-a8f8-97e5e083c03b
短信验证码肯定是正确的,看来肯定和auth状态有关。
对 Cognito 的调用如下所示:
c.cip.SignUp(&cognitoidentityprovider.SignUpInput{
ClientId: aws.String(c.clientID),
Username: aws.String(username),
Password: aws.String(password),
UserAttributes: []*cognitoidentityprovider.AttributeType{
{
Name: aws.String("email"),
Value: aws.String(email),
},
{
Name: aws.String("name"),
Value: aws.String(fullName),
},
},
})
c.cip.ConfirmSignUp(&cognitoidentityprovider.ConfirmSignUpInput{
ClientId: aws.String(c.clientID),
Username: aws.String(username),
ConfirmationCode: aws.String(code),
})
//Add the phone number
c.cip.AdminUpdateUserAttributes(&cognitoidentityprovider.AdminUpdateUserAttributesInput{
UserPoolId: aws.String(c.userPoolID),
Username: aws.String(username),
UserAttributes: []*cognitoidentityprovider.AttributeType{
{
Name: aws.String("phone_number"),
Value: aws.String(phoneNumber),
},
},
})
//Request a verification code
c.cip.GetUserAttributeVerificationCode(&cognitoidentityprovider.GetUserAttributeVerificationCodeInput{
AccessToken: aws.String(accessToken),
AttributeName: aws.String("phone_number"),
})
//Verify the phone number
c.cip.VerifyUserAttribute(&cognitoidentityprovider.VerifyUserAttributeInput{
AccessToken: aws.String(accessToken),
AttributeName: aws.String("phone_number"),
Code: aws.String(code),
})
//Enable SMS 2-factor auth c.cip.AdminSetUserSettings(&cognitoidentityprovider.AdminSetUserSettingsInput{
UserPoolId: aws.String(c.userPoolID),
Username: aws.String(username),
MFAOptions: []*cognitoidentityprovider.MFAOptionType{
&cognitoidentityprovider.MFAOptionType{
AttributeName: aws.String("phone_number"),
DeliveryMedium: aws.String("SMS"),
},
},
})
c.cip.AdminInitiateAuth(&cognitoidentityprovider.AdminInitiateAuthInput{
ClientId: aws.String(c.clientID),
UserPoolId: aws.String(c.userPoolID),
AuthFlow: aws.String("ADMIN_NO_SRP_AUTH"),
AuthParameters: map[string]*string{
"USERNAME": aws.String(username),
"PASSWORD": aws.String(password),
},
})
c.cip.AdminRespondToAuthChallenge(&cognitoidentityprovider.AdminRespondToAuthChallengeInput{
ClientId: aws.String(c.clientID),
UserPoolId: aws.String(c.userPoolID),
ChallengeName: aws.String("SMS_MFA"),
Session: aws.String(session),
ChallengeResponses: map[string]*string{
"USERNAME": aws.String(username),
"SMS_MFA_CODE": aws.String(code),
},
})
执行 GetUser 调用会显示用户的当前状态:
User = {
Enabled: true,
MFAOptions: [{
AttributeName: "phone_number",
DeliveryMedium: "SMS"
}],
PreferredMfaSetting: "SMS_MFA",
UserAttributes: [
{
Name: "sub",
Value: "bd2bb8bc-dfe6-4216-829c-5ae975ce24e5"
},
{
Name: "email_verified",
Value: "true"
},
{
Name: "name",
Value: "Ben Vogan"
},
{
Name: "phone_number_verified",
Value: "true"
},
{
Name: "phone_number",
Value: "<redacted>"
},
{
Name: "email",
Value: "<redacted>"
}
],
UserCreateDate: 2018-07-24 03:29:49 +0000 UTC,
UserLastModifiedDate: 2018-07-24 04:19:51 +0000 UTC,
UserMFASettingList: ["SMS_MFA"],
UserStatus: "CONFIRMED",
Username: "bd2bb8bc-dfe6-4216-829c-5ae975ce24e5"
}
我不知道是否有办法查询用户的身份验证状态,以便我可以验证这一点。
AWS 文档和无用的错误让我发疯,所以任何帮助将不胜感激!
Thanks.