node.js - AWS Cognito Migrate 用户 Node.js Lambda 函数已调用但未按预期运行

Question

我创建了一个 Migrate User Lambda 函数并将其连接到我的 AWS Cognito 托管 UI。 lambda 被调用，我在 CloudWatch 日志中看到我的日志语句。一切似乎都正常，只是托管的 UI 似乎没有按预期运行。这几乎就像 Lambda 没有被调用一样，但我知道这是因为我看到了日志语句。托管 UI 始终显示“您输入的用户名或密码无效”，而我希望它将用户带到重置密码工作流程。

我的 Node 功能是:

const https = require('https')

exports.handler = (event, context, callback) => {

    if ( event.triggerSource == "UserMigration_Authentication" ) {


        LoginUser(event.userName, event.request.password, function(user, message){
            
            console.log("Finished LoginUser call.");
            
            if ( user ) {
                console.log("Got a valid user with userId=" + user.userId);
                
                event.response.userAttributes = {
                    "userName" : user.userName,
                    "email": user.emailAddress,
                    "email_verified": "true",
                    "picture" : user.imageUrl,
                    "family_name" : user.lastName,
                    "given_name" : user.firstName,
                    "custom:userId" : user.userId
                };
                event.response.finalUserStatus = "RESET_REQUIRED";
                event.response.messageAction = "SUPPRESS";
                event.response.desiredDeliveryMediums = "EMAIL";
                
                console.log("Done: " + JSON.stringify(event));
                
                //callback(null,event);
                context.succeed(event);
            }
            else {
                console.log("User was not found. " + message );
                callback(message, event);
            }
        });
        
    }
    else if ( event.triggerSource == "UserMigration_ForgotPassword" ) {
        
        /*
         * Check to see if the user exists.  If so, then tell cognito
         * to proceed, given the email address we looked up.
         */
    	LookupUser(event.userName, function(user, message){
    	   
    	   if ( user ) {
    	       
                event.response.userAttributes = {
                    "email": user.emailAddress,
                    "email_verified": "true"  
                };
                event.response.messageAction = "SUPPRESS";

                console.log("Done: " + JSON.stringify(event));
                //callback(null,event);
                context.succeed(event);
    	   } 
    	   else {
    	       callback(message, event);
    	   }
    	   
    	});
	
    }
    else {
        callback("Bad triggerSource " + event.triggerSource);
    }
};





/*
 * Lookup a user
 */
function LookupUser(userName, UserCallback) {
    
    var pathUri = "/api/user?op=or&userName=" + encodeURIComponent(userName);	
    console.log("pathUri=" + pathUri);

    var headers = {
        "x-k-Id": process.env.kmpzPublicKey,
        "x-k-Sig": process.env.kmpzSecretKey
    };
    
    var options = {
        host: "www.mydomainhere.com",
        port: 443,
        path: pathUri,
        method: "GET",
        headers: headers
    };    

    var req = https.request(options, function(res) {  
        res.on('data', function(data) {
            
            var user = JSON.parse(data);
            console.log(user);
            
            if ( user.error ) {
                UserCallback(null, user.error.message);
            }
            else if ( user.userId ) {
                UserCallback(user, "OK");
            }
            else {
                UserCallback(null, "Unexpected response from userService.  Please contact Kompoz Customer Support.");
            }
        });
    });    
    
    req.on('error', function(e) {
        UserCallback(null, e.message);
    });    
  
    req.end();    
};



/*
 * Login a user
 */
function LoginUser(userName, userPassword, UserCallback) {
    
    var pathUri = "/api/auth/migrate?userName=" + encodeURIComponent(userName) + "&password=" + encodeURIComponent(userPassword);
    console.log("pathUri=" + pathUri);

    var headers = {
        "x-k-Id": process.env.kmpzPublicKey,
        "x-k-Sig": process.env.kmpzSecretKey
    };
    
    var options = {
        host: "www.mydomainhere.com",
        port: 443,
        path: pathUri,
        method: "POST",
        headers: headers
    };    

    var req = https.request(options, function(res) {  
        res.on('data', function(data) {
            
            var user = JSON.parse(data);
            console.log(user);
            
            if ( user.error ) {
                UserCallback(null, user.error.message);
            }
            else if ( user.userId ) {
                UserCallback(user, "OK");
            }
            else {
                UserCallback(null, "Unexpected response from userService.  Please contact Kompoz Customer Support.");
            }
        });
    });    
    
    req.on('error', function(e) {
        UserCallback(null, e.message);
    });    
  
    req.end();    
};

在 CloudWatch 日志中，我看到了响应:

{
    "version": "1",
    "triggerSource": "UserMigration_Authentication",
    "region": "us-east-1",
    "userPoolId": "us-east-1_******",
    "userName": "exampleUser",
    "callerContext": {
        "awsSdkVersion": "aws-sdk-unknown-unknown",
        "clientId": "2s12aui53t9a4n85orc3d3ul0u"
    },
    "request": {
        "password": "*******",
        "validationData": null,
        "userAttributes": null
    },
    "response": {
        "userAttributes": {
            "userName": "exampleUser",
            "email": "me@example.com",
            "email_verified": "true",
            "picture": "https://s3.amazonaws.com/example-s3/images/m1006-20140119-033844-p2.jpg",
            "family_name": "Smith",
            "given_name": "John",
            "custom:userId": 1006
        },
        "forceAliasCreation": null,
        "finalUserStatus": "RESET_REQUIRED",
        "messageAction": "SUPPRESS",
        "desiredDeliveryMediums": "EMAIL"
    }
}

这是我得到的:

Answer 1

希望我能帮忙。只是在这里说“我也是”。您收到 HTTP/401 错误吗？我的 lambda 也在运行，但我无法跳过错误消息。 cloudwatch 中没有日志，cloudtrail 中没有提示。

HTML/401

Request URL: https://******.auth.us-west-2.amazoncognito.com/login?response_type=code&client_id=**************************&redirect_uri=https://local.******.com/auth/login
Request Method: GET
Status Code: 401 
Remote Address: 54.191.35.239:443
Referrer Policy: no-referrer-when-downgrade
cache-control: private
content-language: en-US
content-type: text/html;charset=UTF-8
date: Mon, 02 Sep 2019 04:45:17 GMT
expires: Thu, 01 Jan 1970 00:00:00 UTC
server: Server
set-cookie: cognito-fl="W10="; Version=1; Path=/; Secure; HttpOnly
status: 401
strict-transport-security: max-age=31536000 ; includeSubDomains
x-amz-cognito-request-id: 18e6f6e5-6c85-4280-81ac-b90428d66202
x-application-context: application:prod:8443
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
:authority: ******.auth.us-west-2.amazoncognito.com
:method: GET
:path: /login?response_type=code&client_id=************************&redirect_uri=https://local.******.com/auth/login
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cache-control: no-cache
cookie: XSRF-TOKEN=b4c1c540-6eac-4309-bd81-1ce3cc54e259; cognito-fl="W3sidGFyZ2V0UmVxdWVzdFBhdGgiOiIvbG9naW4iLCJtYXAiOnsibG9naW5FcnJvck1lc3NhZ2UiOiJUaGUgdXNlcm5hbWUgb3IgcGFzc3dvcmQgeW91IGVudGVyZWQgaXMgaW52YWxpZCJ9fV0="
dnt: 1
pragma: no-cache
referer: https://******.auth.us-west-2.amazoncognito.com/login?response_type=code&client_id=***********************&redirect_uri=https://local.******.com/auth/login
sec-fetch-mode: navigate
sec-fetch-site: same-origin
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36
response_type: code
client_id: ****************
redirect_uri: https://local.******.com/auth/login

Lambda 响应

{
  "version": "1",
  "triggerSource": "UserMigration_Authentication",
  "region": "us-west-2",
  "userPoolId": "us-west-2_KIcLJftsn",
  "userName": "eflyerman@gmail.com",
  "callerContext": {
    "awsSdkVersion": "aws-sdk-unknown-unknown",
    "clientId": "**********************"
  },
  "request": {
    "password": "*********",
    "validationData": null,
    "userAttributes": null
  },
  "response": {
    "userAttributes": {
      "email_verified": true,
      "phone_number": "281******",
      "given_name": "E***e",
      "middle_name": "",
      "family_name": "S*****",
      "custom:role": "doctor|admin|",
      "custom:user_id": 528
    },
    "forceAliasCreation": null,
    "finalUserStatus": "CONFIRMED",
    "messageAction": "SUPPRESS",
    "desiredDeliveryMediums": "EMAIL"
  }
}