Authenticate a User via email

[Matthew-Heironimus]

If I follow the example "Authenticate a User" shown on the http://docs.aws.amazon.com/cognito/latest/developerguide/using-amazon-cognito-user-identity-pools-javascript-examples.html page or the "Use case 4" example on the https://github.com/aws/amazon-cognito-identity-js/blob/master/README.md page using the Username, the example works.

I am trying to authenticate a user using their email attribute, rather than their username. I have marked the email attribute as an Alias in my User Pool. When I use email in place of username in the "Authenticate a User" example I get the following error: ResourceNotFoundException: Username/client id combination not found. I have included my code sample below.

How does one Authenticate a User via email address?

Code Sample

function authenticateUserViaEmail() {

    log("authenticateUserViaEmail called");

    // Initialize the Amazon Cognito credentials provider
    AWS.config.region = 'us-east-1'; // Region
    AWS.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: identityPoolId,
    });

    AWSCognito.config.region = 'us-east-1';
    AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({
        IdentityPoolId: identityPoolId,
    });

    var authenticationData = {
        Username : document.getElementById("email").value,
        Password : document.getElementById("password").value
    };

    log("using: " + JSON.stringify(authenticationData));

    var authenticationDetails = new AWSCognito.CognitoIdentityServiceProvider.AuthenticationDetails(authenticationData);
    var poolData = { UserPoolId : userPoolId,
        ClientId : clientId
    };
    var userPool = new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(poolData);
    var userData = {
        Username : document.getElementById("email").value,
        Pool : userPool
    };
    var cognitoUser = new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData);

    log("About to call authenticateUser...");

    cognitoUser.authenticateUser(authenticationDetails, {
        onSuccess: function (result) {
            log('Access token: ' + result.getAccessToken().getJwtToken());
        },
        onFailure: function(err) {
            log(err);
            console.error(err);
        },
    });            
}

[itrestian]

Did you confirm your email address? If you did not confirm your email address, it cannot be used as an alias for logging in.

[Matthew-Heironimus]

That might be the issue. The User Status is "Enabled / Confirmed", but email_verified is showing false. I will update this tomorrow and retest. Thanks for the information.

[Matthew-Heironimus]

@itrestian Thank you for your input. That was indeed my issue. The email address had not been confirmed. Once the email was confirmed, it started working. Thanks again.

[borosio]

@Matthew-Heironimus I have the same case: An user status "Enabled / Confirmed", but email verified is false. Did you delete the user and register him again? Or is it possible change to email verified after an user has been confirmed?

[Matthew-Heironimus]

You do not need to delete the user, you just need the user to confirm their e-mail address. This can be done using the getAttributeVerificationCode API call (see https://github.com/aws/amazon-cognito-identity-js#usage for more details).

Example:

        cognitoUser.getAttributeVerificationCode('email', {
            onSuccess: function (result) {
                log('Call result: ' + result);
            },
            onFailure: function(err) {
                log(err);
            },
            inputVerificationCode() {
                var verificationCode = prompt('Check you email for a verification code and enter it here: ' ,'');
                cognitoUser.verifyAttribute('email', verificationCode, this);
            }
        });            

[borosio]

Thanks, @Matthew-Heironimus. Do you know what happen if my user is registered in my userpool (with trigger post-signup he was confirmed), but he did not confirm the email (email_verified is false) and he does not remember his password?

[borosio]

Is it possible change email_verified to true without send email with a trigger in pre-signup, like the event.response.autoConfirmUser = true;

[Matthew-Heironimus]

Is it possible change email_verified to true without send email with a trigger in pre-signup, like the event.response.autoConfirmUser = true;

Not to my knowledge, but I am no expert. You might try creating a new "Issue" for that question.

[RickDT]

You can via a Lambda script.

Rick

On Jul 25, 2016, at 9:35 AM, Matthew Heironimus notifications@github.com wrote:

Is it possible change email_verified to true without send email with a trigger in pre-signup, like the event.response.autoConfirmUser = true;

Not to my knowledge, but I am no expert. You might try creating a new "Issue" for that question.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[RickDT]

Set event.response.autoConfirmUser = true in the Lambda trigger.

On Jul 19, 2016, at 12:36 PM, borosio notifications@github.com wrote:

Is it possible change email_verified to true without send email with a trigger in pre-signup, like the event.response.autoConfirmUser = true;

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[borosio]

Thanks, @RickDT My users need be authenticated immediately at least with his username and after with his email (alias). The questions is how can I send email verification when my user is confirmed and email_verified=false, in my userpool email is required and is an alias. According the API, getUserAttributeVerificationCode is with authenticated user.

[Arekusei]

Somebody know? Is it possible change email_verified to true without send email with a trigger in pre-signup?

[borosio]

@Arekusei If your users are confirmed via trigger pre-signup, your application must to have a link visible to authenticated user. The link invoke the getUserAttributeVerificationCode to send the email and after introduce the code.

[Arekusei]

@borosio I need to get around the verification mechanism. Since the database they already have been verified before and they just need to quietly migrate to cognito authorization.

[hithisisneel]

@Arekusei Were you able to figure out how to set the email_verified to true from the pre-signup lambda? The documentation mentions "You can also mark a user's email or phone number verified through this trigger." But I dont find the place to set it, because the pre-signup lambda response only specifies autoConfirmUser.

[Arekusei]

@hithisisneel No, we have abandoned Cognito. It is much faster to make an API for authentication and registration, than to deal with Cognito and its limitations.

[twxia]

Hi @hithisisneel , @Arekusei

Just set event.response.autoVerifyEmail = true; in the trigger

[iflp]

Hi @twxia, which trigger? I can't find it in the documentation for trigger examples. http://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html

Working with Cognito was a mistake 😞

[twxia]

@ragingnerd pre sign-up http://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html#aws-lambda-triggers-pre-registration-example

By using autoVerifyEmail, it' ll not verify the reality of the email (won't send the email verification code).

[hithisisneel]

Yes this works. I got this answer in the aws cognito forum too. They said their documentation is not updated. In the pre-signup lambda trigger response, along with autoConfimUser = true, you can also set autoVerifyEmail = true and autoVerifyPhone = true if required. But please note as @twxia said, this will simply override the verification status to true. It'll not actually verify the email by sending confirmation code etc.

[iflp]

Hey @hithisisneel @twxia thanks for the reply. I have opened a new issue https://github.com/aws/amazon-cognito-identity-js/issues/322 as I need to disabled email verification on update to the email user attribute, not on signup.

[heitoor]

Is there a way to validate only the email? Not the user.

I am using SMS to validate the user, but this only verify the cell phone. I dont want to send him an email with another code.

I try to use only autoVerifyEmail, but gives me errors. And the full lambada, auth the user without asking him the SMS code.