Signin with Custom Auth With SRP issues token without triggering the CUSTOM_CHALLENGE #2566
Comments
mattcreaser
added
auth
|
Hi @doanpt thank you so much for doing all the necessary pre-requisites before we could investigate. It really helped me understand your issue and what the potential problem could be.
In your case what is happening is that even though custom_auth is invoked the lamdas are not sending the custom_auth challenge back to the app and instead the credentials are being returned. If credentials are returned the sign in flow finishes. Please ensure your lambdas are working correctly (you can ensure that by debugging the DEFINE lambda to understand the incoming and outgoing requests a bit better). I will leave this issue open for a week to see if this suggestion helped you. If you still need help please reach out with your lambda code and I can troubleshoot further. |
gpanshu
added
pending-community-response
|
As I re-read your issue I would like you to ensure 2 things:
|
|
thanks for your reply
Precondition:
From my steps. that wrong in step 2 but I think. if signIn method be called multiple times AWS should not return token and auth result... |
gpanshu
removed
the
pending-community-response
|
If you toggle the SRP off and login via CUSTOM_AUTH_WITH_SRP it will ensure your lambdas are being called. This will have no consequence to your MFA toggled on/off. Please try the steps I have requested in your local machine to see if that solves your issue. Also when I read your steps they are very APP dependent and not Amplify dependent (for example press back button and go back to login screen - need to understand what is going on here, are you calling signout when you go to that screen? what state is signin state machine at that point). Feel free to setup a call with me if the steps I suggested do not work here |
gpanshu
added
the
pending-community-response
|
hi, I would like to add, in the step that I describe. I know maybe the app is wrong, but it's wrong for the app to be in the wrong state and the amplify or bankend team returns the token, that needs to be fixed for security. |
|
Amplify Android team have checked the sign-in protocols and can confirm that the secondary sign is not allowed once a sign in is successfully performed. We advise that you check your backend lambdas to understand why you are being issues tokens when you have not satisfied your custom challenge. Once you have your custom lambdas and you need support please do not hesitate to contact us. |
|
Thanks, I will contact with our cloud team to check that. |
|
Closing due to inactivity. Please feel free to create a new issue if you are still experiencing issues. |
|
Before opening, please confirm:
Language and Async Model
Kotlin - Coroutines
Amplify Categories
Authentication
Gradle script dependencies
Environment information
Please include any relevant guides or documentation you're referencing
https://docs.amplify.aws/lib/auth/signin_with_custom_flow/q/platform/android/#custom-auth-flow-with-srp
Describe the bug
My app used Amplify 0.1.32.0, but sometimes my app crashed after submitting MFA that described on issue:#2560
After research and I see the same issue that occurred and may resolve on the new version, So I decided to upgrade to Amplify V2,
But we faced a new issue that was described on #2331. On that issue, your team said it was fixed on version 24.0 and 2.11.0 but I am still facing it on version 2.11.2.
In our application using amplify 2.11.2, during login, the user will need to enter the correct password and then the user will need to enter MFA for confirmation, however, we try again and again in case the user enters the correct password and then enter the wrong mfa. After a period of repeating that action, after the user enters the correct password, the user directly enters the home screen without having to enter the MFA. This issue never occurred on my application with amplify version 0.1.32.0
I added Amplify.addPlugin(AndroidLoggingPlugin(LogLevel.VERBOSE)) this plugin and you can read detailed log.
Note that: Issue occurred on 08-18 16:21:55.198, app received AuthSignInResult as AuthSignInResult{isSignedIn=true, nextStep=AuthNextSignInStep{signInStep=DONE, additionalInfo={}, codeDeliveryDetails=null}} even though only enter the correct password and don't see the request to enter the MFA
Reproduction steps (if applicable)
Code Snippet
Log output
amplifyconfiguration.json
GraphQL Schema
Additional information and screenshots
No response
The text was updated successfully, but these errors were encountered: