amazon-web-services - AWS Cognito 用户迁移池触发器不适用于登录流程

Question

我正在使用具有认知执行角色的 Lambda 函数进行 AWS 认知池迁移
以下是我的新池应用客户端设置



或者


AWS 文档说

User migration authentication flow A user migration Lambda trigger allows easy migration of users from a legacy user management system into your user pool. To avoid making your users reset their passwords during user migration, choose the USER_PASSWORD_AUTH authentication flow. This flow sends your users' passwords to the service over an encrypted SSL connection during authentication.

When you have completed migrating all your users, we recommend switching flows to the more secure SRP flow. The SRP flow does not send any passwords over the network.

我创建了角色为“AmazonCognitoPowerUser”的 lambda 函数

        async function authenticateUser(cognitoISP: CognitoIdentityServiceProvider, username: string, password: string): Promise<User | undefined> {
            console.log(`authenticateUser: user='${username}'`);

            const params: AdminInitiateAuthRequest = {
                AuthFlow: 'ADMIN_USER_PASSWORD_AUTH',
                AuthParameters: {
                    PASSWORD: password,
                    USERNAME: username,
                },
                ClientId: OLD_CLIENT_ID,
                UserPoolId: OLD_USER_POOL_ID,
            };
            const cognitoResponse = await cognitoISP.adminInitiateAuth(params).promise();
            const awsError: AWSError = cognitoResponse as any as AWSError;
            if (awsError.code && awsError.message) {
                console.log(`authenticateUser: error ${JSON.stringify(awsError)}`);
                return undefined;
            }
            console.log(`authenticateUser: found ${JSON.stringify(cognitoResponse)}`);

            return lookupUser(cognitoISP, username);
        }

        async function lookupUser(cognitoISP: CognitoIdentityServiceProvider, username: string): Promise<User | undefined> {
            console.log(`lookupUser: user='${username}'`);
            const params = {
                UserPoolId: OLD_USER_POOL_ID,
                Username: username,
            };
            const cognitoResponse = await cognitoISP.adminGetUser(params).promise();
            const awsError: AWSError = cognitoResponse as any as AWSError;
            if (awsError.code && awsError.message) {
                console.log(`lookupUser: error ${JSON.stringify(awsError)}`);
                return undefined;
            }
            console.log(`lookupUser: found ${JSON.stringify(cognitoResponse)}`);

            const userAttributes = cognitoResponse.UserAttributes ? cognitoResponse.UserAttributes.reduce((acc, entry) => ({
                ...acc,
                [entry.Name]: entry.Value,
            }), {} as {[key: string]: string | undefined}) : {};
            const user: User = {
                userAttributes,
                userName: cognitoResponse.Username,
            };
            console.log(`lookupUser: response ${JSON.stringify(user)}`);
            return user;
        }

        async function onUserMigrationAuthentication(cognitoISP: CognitoIdentityServiceProvider, event: CognitoUserPoolTriggerEvent) {
            // authenticate the user with your existing user directory service
            const user = await authenticateUser(cognitoISP, event.userName!, event.request.password!);
            if (!user) {
                throw new Error('Bad credentials');
            }

            event.response.userAttributes = {
                // old_username: user.userName,
                // 'custom:tenant': user.userAttributes['custom:tenant'],
                email: user.userAttributes.email!,
                email_verified: 'true',
                preferred_username: user.userAttributes.preferred_username!,
            };
            event.response.finalUserStatus = 'CONFIRMED';
            event.response.messageAction = 'SUPPRESS';

            console.log(`Authentication - response: ${JSON.stringify(event.response)}`);
            return event;
        }

        async function onUserMigrationForgotPassword(cognitoISP: CognitoIdentityServiceProvider, event: CognitoUserPoolTriggerEvent) {
            // Lookup the user in your existing user directory service
            const user = await lookupUser(cognitoISP, event.userName!);
            if (!user) {
                throw new Error('Bad credentials');
            }

            event.response.userAttributes = {
                // old_username: user.userName,
                // 'custom:tenant': user.userAttributes['custom:tenant'],
                email: user.userAttributes.email!,
                email_verified: 'true',
                preferred_username: user.userAttributes.preferred_username!,
            };
            event.response.messageAction = 'SUPPRESS';

            console.log(`Forgot password - response: ${JSON.stringify(event.response)}`);

            return event;
        }

        export const handler = async (event: CognitoUserPoolTriggerEvent, context: Context): Promise<CognitoUserPoolTriggerEvent> => {
            const options: CognitoIdentityServiceProvider.Types.ClientConfiguration = {
                region: OLD_USER_POOL_REGION,
            };
            if (OLD_ROLE_ARN) {
                options.credentials = new ChainableTemporaryCredentials({
                    params: {
                        ExternalId: OLD_EXTERNAL_ID,
                        RoleArn: OLD_ROLE_ARN,
                        RoleSessionName: context.awsRequestId,
                    },
                });
            }
            const cognitoIdentityServiceProvider = new CognitoIdentityServiceProvider(options);

            switch (event.triggerSource) {
                case 'UserMigration_Authentication':
                    return onUserMigrationAuthentication(cognitoIdentityServiceProvider, event);
                case 'UserMigration_ForgotPassword':
                    return onUserMigrationForgotPassword(cognitoIdentityServiceProvider, event);
                default:
                    throw new Error(`Bad triggerSource ${event.triggerSource}`);
            }
        }

并将触发器添加到新池中，



多次尝试后，Lambda 触发器无法登录总是出错。

  {__type: "NotAuthorizedException", message: "Incorrect username or password."}
       message: "Incorrect username or password."
     __type: "NotAuthorizedException"

虽然如果我们在重置密码用户迁移到新池后使用忘记密码流程它工作正常

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-import-using-lambda.html

更新:

当使用以下 json 直接在 lambda 上运行测试时

  {
   "version": "1",
   "triggerSource": "UserMigration_Authentication",
   "region": "ap-south-1",
   "userPoolId": "ap-XXXXXXXXX2",
   "userName": "vaquar.test@gmail.com",
   "callerContext": {
   "awsSdkVersion": "aws-sdk-unknown-unknown",
   "clientId": "1XXXXXXXXXXXXXXXXXXfgk"
   },
   "request": {
   "password": "vkhan",
   "validationData": null,
   "userAttributes": null
    },
   "response": {
    "userAttributes": null,
    "forceAliasCreation": null,
    "finalUserStatus": null,
    "messageAction": null,
    "desiredDeliveryMediums": null
    }
  }

然后获得以下响应并且用户迁移到新池意味着我们在登录过程中遇到触发器问题。

 INFO   Authentication - response: {"userAttributes":{"email":"vaquar.test@gmail.com","email_verified":"true"},"forceAliasCreation":null,"finalUserStatus":"CONFIRMED","messageAction":"SUPPRESS","desiredDeliveryMediums":null}

Answer 1

通过 Lambda 触发器，Cognito 服务调用 Lambda 函数。所以 Cognito 将需要 permission to invoke Lambda function .您如何在用户池上配置 Lambda 触发器？如果您使用 AWS Cognito 控制台，则应自动设置权限。

您也可以 verify if the user already exists in the new userpool这可能会导致这种行为。