Skip to content

Commit 1fba05c

Browse files
joon-wonJoonWon Choi
andauthored
restore autoSignIn section for SignIn page, and Switching Authentication Flows page for js categories (#7769)
Co-authored-by: JoonWon Choi <joonwonc@amazon.com>
1 parent 09779ce commit 1fba05c

File tree

2 files changed

+104
-0
lines changed
  • src/pages/[platform]/build-a-backend/auth/connect-your-frontend

2 files changed

+104
-0
lines changed

src/pages/[platform]/build-a-backend/auth/connect-your-frontend/sign-in/index.mdx

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -659,6 +659,19 @@ signInWithRedirect({ provider: {
659659
}})
660660
```
661661

662+
### Auto sign-in
663+
664+
The `autoSignIn` API will automatically sign-in a user when it was previously enabled by the `signUp` API and after any of the following cases has completed:
665+
666+
- User confirmed their account with a verification code sent to their phone or email (default option).
667+
- User confirmed their account with a verification link sent to their phone or email. In order to enable this option you need to go to the [Amazon Cognito console](https://aws.amazon.com/pm/cognito), look for your userpool, then go to the `Messaging` tab and enable `link` mode inside the `Verification message` option. Finally you need to define the `signUpVerificationMethod` to `link` inside the `Cognito` option of your `Auth` config.
668+
669+
```ts title="src/main.ts"
670+
import { autoSignIn } from 'aws-amplify/auth';
671+
672+
await autoSignIn();
673+
```
674+
662675
</InlineFilter>
663676
<InlineFilter filters={['react-native']}>
664677

src/pages/[platform]/build-a-backend/auth/connect-your-frontend/switching-authentication-flows/index.mdx

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,13 @@ export const meta = {
44
title: 'Switching authentication flows',
55
description: 'Learn how to switch between different auth flows',
66
platforms: [
7+
'angular',
8+
'javascript',
9+
'nextjs',
10+
'react',
11+
'react-native',
712
'swift',
13+
'vue'
814
]
915
};
1016

@@ -20,6 +26,8 @@ export function getStaticProps() {
2026
};
2127
}
2228

29+
<InlineFilter filters={["swift"]}>
30+
2331
`AWSCognitoAuthPlugin` allows you to switch between different auth flows while initiating signIn. You can configure the flow in the `amplifyconfiguration.json` file or pass the `authFlowType` as a runtime parameter to the `signIn` api call.
2432

2533
For client side authentication there are four different flows that can be configured during runtime:
@@ -105,6 +113,89 @@ The flow is initiated by calling `signIn` with `AuthSignInOptions` configured wi
105113

106114
Follow the instructions in [Custom Auth Sign In](/gen1/[platform]/build-a-backend/auth/sign-in-custom-flow/) to learn about how to integrate custom authentication flow in your application with the Auth APIs.
107115

116+
</InlineFilter>
117+
118+
<InlineFilter filters={["angular", "javascript", "nextjs", "react", "react-native", "vue"]}>
119+
120+
For client side authentication there are three different flows:
121+
122+
1. `USER_SRP_AUTH`: The `USER_SRP_AUTH` flow uses the [SRP protocol (Secure Remote Password)](https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol) where the password never leaves the client and is unknown to the server. This is the recommended flow and is used by default.
123+
124+
2. `USER_PASSWORD_AUTH`: The `USER_PASSWORD_AUTH` flow will send user credentials to the backend without applying SRP encryption. If you want to migrate users to Cognito using the "Migration" trigger and avoid forcing users to reset their passwords, you will need to use this authentication type because the Lambda function invoked by the trigger needs to verify the supplied credentials.
125+
126+
3. `CUSTOM_WITH_SRP` & `CUSTOM_WITHOUT_SRP`: Allows for a series of challenge and response cycles that can be customized to meet different requirements.
127+
128+
The Auth flow can be customized when calling `signIn`, for example:
129+
130+
```ts title="src/main.ts"
131+
await signIn({
132+
username: "hello@mycompany.com",
133+
password: "hunter2",
134+
options: {
135+
authFlowType: 'USER_PASSWORD_AUTH'
136+
}
137+
})
138+
```
139+
140+
> For more information about authentication flows, please visit [AWS Cognito developer documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.html#amazon-cognito-user-pools-custom-authentication-flow)
141+
142+
## USER_PASSWORD_AUTH flow
143+
144+
A use case for the `USER_PASSWORD_AUTH` authentication flow is migrating users into Amazon Cognito
145+
146+
### Set up auth backend
147+
148+
In order to use the authentication flow `USER_PASSWORD_AUTH`, your Cognito app client has to be configured to allow it. In the AWS Console, this is done by ticking the checkbox at General settings > App clients > Show Details (for the affected client) > Enable username-password (non-SRP) flow. If you're using the AWS CLI or CloudFormation, update your app client by adding `USER_PASSWORD_AUTH` to the list of "Explicit Auth Flows".
149+
150+
### Migrate users with Amazon Cognito
151+
152+
Amazon Cognito provides a trigger to migrate users from your existing user directory seamlessly into Cognito. You achieve this by configuring your User Pool's "Migration" trigger which invokes a Lambda function whenever a user that does not already exist in the user pool authenticates, or resets their password.
153+
154+
In short, the Lambda function will validate the user credentials against your existing user directory and return a response object containing the user attributes and status on success. An error message will be returned if an error occurs. Visit [Amazon Cognito user pools import guide](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-import-using-lambda.html) for migration flow and more detailed instruction, and [Amazon Cognito Lambda trigger guide](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html#cognito-user-pools-lambda-trigger-syntax-user-migration) on how to set up lambda to handle request and response objects.
155+
156+
## `CUSTOM_WITH_SRP` & `CUSTOM_WITHOUT_SRP` flows
157+
158+
Amazon Cognito user pools supports customizing the authentication flow to enable custom challenge types,
159+
in addition to a password in order to verify the identity of users. These challenge types may include CAPTCHAs
160+
or dynamic challenge questions. The `CUSTOM_WITH_SRP` flow requires a password when calling `signIn`. Both of
161+
these flows map to the `CUSTOM_AUTH` flow in Cognito.
162+
163+
To define your challenges for custom authentication flow, you need to implement three Lambda triggers for Amazon Cognito.
164+
165+
<Callout>
166+
167+
For more information about working with Lambda Triggers for custom authentication challenges, please visit [Amazon Cognito Developer Documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html).
168+
169+
</Callout>
170+
171+
### Custom authentication flow
172+
173+
To initiate a custom authentication flow in your app, call `signIn` without a password. A custom challenge needs to be answered using the `confirmSignIn` API:
174+
175+
```ts title="src/main.ts"
176+
import { signIn, confirmSignIn } from 'aws-amplify/auth';
177+
178+
const challengeResponse = 'the answer for the challenge';
179+
180+
const { nextStep } = await signIn({
181+
username,
182+
options: {
183+
authFlowType: 'CUSTOM_WITHOUT_SRP',
184+
},
185+
});
186+
187+
if (nextStep.signInStep === 'CONFIRM_SIGN_IN_WITH_CUSTOM_CHALLENGE') {
188+
// to send the answer of the custom challenge
189+
await confirmSignIn({ challengeResponse });
190+
}
191+
```
192+
193+
### CAPTCHA authentication
194+
195+
To create a CAPTCHA challenge with a Lambda Trigger, please visit [AWS Amplify Google reCAPTCHA challenge example](/[platform]/build-a-backend/functions/examples/google-recaptcha-challenge/) for detailed examples.
196+
197+
</InlineFilter>
198+
108199
<Callout>
109200

110201
For more information about working with Lambda Triggers for custom authentication challenges, please visit [Amazon Cognito Developer Documentation](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html).

0 commit comments

Comments
 (0)