Skip to content

Commit 39a255e

Browse files
mxpvbmoffatt
mxpv
authored and
bmoffatt
committed
Add events for Cognito custom authentication challenge (#168)
* Add events for Cognito custom authentication challenge Signed-off-by: Maksym Pavlenko <[email protected]> * fix inconsitent whitespace in README * Fix Cognito challenge answer type Signed-off-by: Maksym Pavlenko <[email protected]> * Merge master and resolve conflicts Signed-off-by: Maksym Pavlenko <[email protected]> * Update cognito.go ChallengeMetaData -> ChallengeMetadata
1 parent 84efa13 commit 39a255e

6 files changed

+261
-0
lines changed

‎events/README_Cognito_UserPools_CustomAuthLambdaTriggers.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Sample Function
2+
3+
The following is a sample Lambda functions that are used for custom authentication with Cognito User Pools.
4+
These Lambda triggers issue and verify their own challenges as part of a user pool [custom authentication flow](https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.html#amazon-cognito-user-pools-custom-authentication-flow).
5+
6+
Please see instructions for setting up the Cognito triggers at https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html
7+
8+
Define Auth Challenge Lambda Trigger:
9+
```go
10+
package main
11+
12+
import (
13+
"fmt"
14+
15+
"github.com/aws/aws-lambda-go/lambda"
16+
"github.com/aws/aws-lambda-go/events"
17+
)
18+
19+
func handler(event *events.CognitoEventUserPoolsDefineAuthChallenge) (*events.CognitoEventUserPoolsDefineAuthChallenge, error) {
20+
fmt.Printf("Define Auth Challenge: %+v\n", event)
21+
return event, nil
22+
}
23+
24+
func main() {
25+
lambda.Start(handler)
26+
}
27+
```
28+
29+
Create Auth Challenge Lambda Trigger:
30+
```go
31+
package main
32+
33+
import (
34+
"fmt"
35+
36+
"github.com/aws/aws-lambda-go/lambda"
37+
"github.com/aws/aws-lambda-go/events"
38+
)
39+
40+
func handler(event *events.CognitoEventUserPoolsCreateAuthChallenge) (*events.CognitoEventUserPoolsCreateAuthChallenge, error) {
41+
fmt.Printf("Create Auth Challenge: %+v\n", event)
42+
return event, nil
43+
}
44+
45+
func main() {
46+
lambda.Start(handler)
47+
}
48+
```
49+
50+
Verify Auth Challenge Response Lambda Trigger:
51+
```go
52+
package main
53+
54+
import (
55+
"fmt"
56+
57+
"github.com/aws/aws-lambda-go/lambda"
58+
"github.com/aws/aws-lambda-go/events"
59+
)
60+
61+
func handler(event *events.CognitoEventUserPoolsVerifyAuthChallenge) (*events.CognitoEventUserPoolsVerifyAuthChallenge, error) {
62+
fmt.Printf("Verify Auth Challenge: %+v\n", event)
63+
return event, nil
64+
}
65+
66+
func main() {
67+
lambda.Start(handler)
68+
}
69+
```

‎events/cognito.go

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,75 @@ type GroupConfiguration struct {
147147
PreferredRole *string `json:"preferredRole"`
148148
}
149149

150+
// CognitoEventUserPoolsChallengeResult represents a challenge that is presented to the user in the authentication
151+
// process that is underway, along with the corresponding result.
152+
type CognitoEventUserPoolsChallengeResult struct {
153+
ChallengeName string `json:"challengeName"`
154+
ChallengeResult bool `json:"challengeResult"`
155+
ChallengeMetadata string `json:"challengeMetadata"`
156+
}
157+
158+
// CognitoEventUserPoolsDefineAuthChallengeRequest defines auth challenge request parameters
159+
type CognitoEventUserPoolsDefineAuthChallengeRequest struct {
160+
UserAttributes map[string]string `json:"userAttributes"`
161+
Session []*CognitoEventUserPoolsChallengeResult `json:"session"`
162+
}
163+
164+
// CognitoEventUserPoolsDefineAuthChallengeResponse defines auth challenge response parameters
165+
type CognitoEventUserPoolsDefineAuthChallengeResponse struct {
166+
ChallengeName string `json:"challengeName"`
167+
IssueTokens bool `json:"issueTokens"`
168+
FailAuthentication bool `json:"failAuthentication"`
169+
}
170+
171+
// CognitoEventUserPoolsDefineAuthChallenge sent by AWS Cognito User Pools to initiate custom authentication flow
172+
type CognitoEventUserPoolsDefineAuthChallenge struct {
173+
CognitoEventUserPoolsHeader
174+
Request CognitoEventUserPoolsDefineAuthChallengeRequest `json:"request"`
175+
Response CognitoEventUserPoolsDefineAuthChallengeResponse `json:"response"`
176+
}
177+
178+
// CognitoEventUserPoolsCreateAuthChallengeRequest defines create auth challenge request parameters
179+
type CognitoEventUserPoolsCreateAuthChallengeRequest struct {
180+
UserAttributes map[string]string `json:"userAttributes"`
181+
ChallengeName string `json:"challengeName"`
182+
Session []*CognitoEventUserPoolsChallengeResult `json:"session"`
183+
}
184+
185+
// CognitoEventUserPoolsCreateAuthChallengeResponse defines create auth challenge response rarameters
186+
type CognitoEventUserPoolsCreateAuthChallengeResponse struct {
187+
PublicChallengeParameters map[string]string `json:"publicChallengeParameters"`
188+
PrivateChallengeParameters map[string]string `json:"privateChallengeParameters"`
189+
ChallengeMetadata string `json:"challengeMetadata"`
190+
}
191+
192+
// CognitoEventUserPoolsCreateAuthChallenge sent by AWS Cognito User Pools to create a challenge to present to the user
193+
type CognitoEventUserPoolsCreateAuthChallenge struct {
194+
CognitoEventUserPoolsHeader
195+
Request CognitoEventUserPoolsCreateAuthChallengeRequest `json:"request"`
196+
Response CognitoEventUserPoolsCreateAuthChallengeResponse `json:"response"`
197+
}
198+
199+
// CognitoEventUserPoolsVerifyAuthChallengeRequest defines verify auth challenge request parameters
200+
type CognitoEventUserPoolsVerifyAuthChallengeRequest struct {
201+
UserAttributes map[string]string `json:"userAttributes"`
202+
PrivateChallengeParameters map[string]string `json:"privateChallengeParameters"`
203+
ChallengeAnswer interface{} `json:"challengeAnswer"`
204+
}
205+
206+
// CognitoEventUserPoolsVerifyAuthChallengeResponse defines verify auth challenge response parameters
207+
type CognitoEventUserPoolsVerifyAuthChallengeResponse struct {
208+
AnswerCorrect bool `json:"answerCorrect"`
209+
}
210+
211+
// CognitoEventUserPoolsVerifyAuthChallenge sent by AWS Cognito User Pools to verify if the response from the end user
212+
// for a custom Auth Challenge is valid or not
213+
type CognitoEventUserPoolsVerifyAuthChallenge struct {
214+
CognitoEventUserPoolsHeader
215+
Request CognitoEventUserPoolsVerifyAuthChallengeRequest `json:"request"`
216+
Response CognitoEventUserPoolsVerifyAuthChallengeResponse `json:"response"`
217+
}
218+
150219
// CognitoEventUserPoolsCustomMessage is sent by AWS Cognito User Pools before a verification or MFA message is sent,
151220
// allowing a user to customize the message dynamically.
152221
type CognitoEventUserPoolsCustomMessage struct {

‎events/cognito_test.go

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,33 @@ func TestCognitoEventUserPoolsPreTokenGenMarshaling(t *testing.T) {
113113
test.AssertJsonsEqual(t, inputJSON, outputJSON)
114114
}
115115

116+
func TestCognitoEventUserPoolsDefineAuthChallengeMarshaling(t *testing.T) {
117+
var inputEvent CognitoEventUserPoolsDefineAuthChallenge
118+
test.AssertJsonFile(t, "./testdata/cognito-event-userpools-define-auth-challenge.json", &inputEvent)
119+
}
120+
121+
func TestCognitoEventUserPoolsDefineAuthChallengeMalformedJson(t *testing.T) {
122+
test.TestMalformedJson(t, CognitoEventUserPoolsDefineAuthChallenge{})
123+
}
124+
125+
func TestCognitoEventUserPoolsCreateAuthChallengeMarshaling(t *testing.T) {
126+
var inputEvent CognitoEventUserPoolsCreateAuthChallenge
127+
test.AssertJsonFile(t, "./testdata/cognito-event-userpools-create-auth-challenge.json", &inputEvent)
128+
}
129+
130+
func TestCognitoEventUserPoolsCreateAuthChallengeMalformedJson(t *testing.T) {
131+
test.TestMalformedJson(t, CognitoEventUserPoolsCreateAuthChallenge{})
132+
}
133+
134+
func TestCognitoEventUserPoolsVerifyAuthChallengeMarshaling(t *testing.T) {
135+
var inputEvent CognitoEventUserPoolsVerifyAuthChallenge
136+
test.AssertJsonFile(t, "./testdata/cognito-event-userpools-verify-auth-challenge.json", &inputEvent)
137+
}
138+
139+
func TestCognitoEventUserPoolsVerifyAuthChallengeMalformedJson(t *testing.T) {
140+
test.TestMalformedJson(t, CognitoEventUserPoolsVerifyAuthChallenge{})
141+
}
142+
116143
func TestCognitoEventUserPoolsPostAuthenticationMarshaling(t *testing.T) {
117144

118145
// read json from file

‎events/testdata/cognito-event-userpools-create-auth-challenge.json

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"version": "1",
3+
"region": "us-west-2",
4+
"userPoolId": "<userPoolId>",
5+
"userName": "<userName>",
6+
"callerContext": {
7+
"awsSdkVersion": "aws-sdk-unknown-unknown",
8+
"clientId": "<clientId>"
9+
},
10+
"triggerSource": "CreateAuthChallenge_Authentication",
11+
"request": {
12+
"userAttributes": {
13+
"sub": "<sub>",
14+
"cognito:user_status": "CONFIRMED",
15+
"phone_number_verified": "true",
16+
"cognito:phone_number_alias": "+12223334455",
17+
"phone_number": "+12223334455"
18+
},
19+
"challengeName": "CUSTOM_CHALLENGE",
20+
"session": [
21+
{
22+
"challengeName": "PASSWORD_VERIFIER",
23+
"challengeResult": true,
24+
"challengeMetadata": "metadata"
25+
}
26+
]
27+
},
28+
"response": {
29+
"publicChallengeParameters": {
30+
"a": "b"
31+
},
32+
"privateChallengeParameters": {
33+
"c": "d"
34+
},
35+
"challengeMetadata": "challengeMetadata"
36+
}
37+
}

‎events/testdata/cognito-event-userpools-define-auth-challenge.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "1",
3+
"region": "us-west-2",
4+
"userPoolId": "<userPoolId>",
5+
"userName": "<userName>",
6+
"callerContext": {
7+
"awsSdkVersion": "aws-sdk-unknown-unknown",
8+
"clientId": "<clientId>"
9+
},
10+
"triggerSource": "DefineAuthChallenge_Authentication",
11+
"request": {
12+
"userAttributes": {
13+
"sub": "<sub>",
14+
"cognito:user_status": "CONFIRMED",
15+
"phone_number_verified": "true",
16+
"cognito:phone_number_alias": "+12223334455",
17+
"phone_number": "+12223334455"
18+
},
19+
"session": [
20+
{
21+
"challengeName": "PASSWORD_VERIFIER",
22+
"challengeResult": true,
23+
"challengeMetadata": "metadata"
24+
}
25+
]
26+
},
27+
"response": {
28+
"challengeName": "challengeName",
29+
"issueTokens": true,
30+
"failAuthentication": true
31+
}
32+
}

‎events/testdata/cognito-event-userpools-verify-auth-challenge.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"version": "1",
3+
"region": "us-west-2",
4+
"userPoolId": "<userPoolId>",
5+
"userName": "<userName>",
6+
"callerContext": {
7+
"awsSdkVersion": "aws-sdk-unknown-unknown",
8+
"clientId": "<clientId>"
9+
},
10+
"triggerSource": "VerifyAuthChallengeResponse_Authentication",
11+
"request": {
12+
"userAttributes": {
13+
"sub": "<sub>",
14+
"cognito:user_status": "CONFIRMED",
15+
"phone_number_verified": "true",
16+
"cognito:phone_number_alias": "+12223334455",
17+
"phone_number": "+12223334455"
18+
},
19+
"privateChallengeParameters": {
20+
"secret": "11122233"
21+
},
22+
"challengeAnswer": "123xxxx"
23+
},
24+
"response": {
25+
"answerCorrect": true
26+
}
27+
}

0 commit comments

Comments
 (0)