ustaxcourt / ef-cms

An Electronic Filing / Case Management System.
https://dawson.ustaxcourt.gov/
Other
84 stars 44 forks source link

Migrate Cognito pool to one with case-insensitive user names. #916

Open mark-meyer opened 3 years ago

mark-meyer commented 3 years ago

As a user, I would like to login to Dawson with case-insensitive user names. For example, if I originally signed up with "SomeName@example.com", I would like to be able to login with "somename@example.com"

Pre-Conditions

A deployed Cognito pool without the Enable case insensitivity for username input feature enabled.

Acceptance Criteria

Mobile Design/Considerations

Security Considerations

Notes

Dawson's Cognito pools were originally created without the Enable case insensitivity for username input enabled. This creates a situation where users who created a login with "SOMENAME@example.com" cannot login with "somename@example.com". Unfortunately, the setting to allow case-insensitive usernames cannot be changed after the user pool is created.

Cognito has a Migrate User Lambda Trigger which is fired whenever a user that is not currently in the user pool attempts to login. The lambda is passed the user's name and password and can be used to move the user to a new pool as described here.

Tasks

Definition of Done (Updated 2-23-21)

Product Owner

UX

Engineering

mark-meyer commented 3 years ago

A possible workflow might look like:

  1. Setup new pool with no users (and case-insensitive)
  2. User tries to login, but is not in the new pool yet
  3. The lambda trigger is called with name/password
  4. Use these credentials it to try to validate user in the old pool
  5. If step 4 was successful, return context.succeed() and the user is created in the new pool with this password.
  6. If step 4 is not successful, it’s a failed login attempt.