feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Tietew · 2024-12-03T06:47:10Z

Issue # (if applicable)

Reason for this change

User Pool has introduced choice-based authentication, including passwordless sign-in and passkey (WebAuthn) sign-in.
For details, see Manage authentication methods in AWS SDKs.

Related PRs:

feat(cognito): user pool feature plans #32367 - requires Essentials or higher feature plan
feat(cognito): support for ALLOW_USER_AUTH explicit auth flow #32273 - requires User pool client to allow USER_AUTH auth flow

Description of changes

Added following properties:

allowedFirstAuthFactors - allowed first authenticate factors
passkeyRelyingPartyId - the authentication domain used as passkey relying party ID
passkeyUserVerification - configure user verification to be preferred or required

Description of how you validated changes

Added unit test and an integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

codecov · 2024-12-03T06:59:39Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.00%. Comparing base (b11f663) to head (b8b00ef).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32369   +/-   ##
=======================================
  Coverage   81.00%   81.00%           
=======================================
  Files         238      238           
  Lines       14269    14269           
  Branches     2492     2492           
=======================================
  Hits        11558    11558           
  Misses       2425     2425           
  Partials      286      286

Flag	Coverage Δ
suite.unit	`81.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`79.92% <ø> (ø)`
packages/aws-cdk-lib/core	`82.16% <ø> (ø)`

### Issue # (if applicable) N/A ### Reason for this change Amazon Cognito introduces the feature plans which replaces the Advanced Security Mode. See: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html Related to #32369 - passwordless sign-in requires Essentials or higher feature plan. ### Description of changes - Add new `featurePlan` property and `FeaturePlan` enum to specify user pool feature plan. - Deprecate `advancedSecurityMode` property and `AdvancedSecurityMode` enum. Note that the previous AWS document about Advanced Security Mode is now redirected to [Advanced security with threat protection](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.html). ### Description of how you validated changes Added new unit tests and an integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

lpizzinidev

👍 Sorry for the super-late review

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

packages/aws-cdk-lib/aws-cognito/test/user-pool.test.ts

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

Tietew · 2025-01-30T03:23:51Z

@lpizzinidev Thank you for your comments! I've pushed some modifications.

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

lpizzinidev

My idea was to enforce password: true regardless when setting allowedFirstAuthFactors. Please let me know what's your thought 👍

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

lpizzinidev · 2025-02-04T09:00:41Z

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

+    /*
+     * Choice-based authentication is enabled when built allowedFirstAuthFactors contains any factor but PASSWORD.
+     * This check should be placed here to supply the way to disable choice-based authentication explicitly
+     * by specifying `allowedFirstAuthFactors: { password: true }`.
+     */
+    const isChouseBasedAuthenticationEnabled = allowedFirstAuthFactors.some((auth) => auth !== 'PASSWORD');
+    if (isChouseBasedAuthenticationEnabled && props.featurePlan === FeaturePlan.LITE) {
      throw new ValidationError('To enable choice-based authentication, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.', this);


Suggested change

/*

* Choice-based authentication is enabled when built allowedFirstAuthFactors contains any factor but PASSWORD.

* This check should be placed here to supply the way to disable choice-based authentication explicitly

* by specifying `allowedFirstAuthFactors: { password: true }`.

*/

const isChouseBasedAuthenticationEnabled = allowedFirstAuthFactors.some((auth) => auth !== 'PASSWORD');

if (isChouseBasedAuthenticationEnabled && props.featurePlan === FeaturePlan.LITE) {

throw new ValidationError('To enable choice-based authentication, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.', this);

if (props.featurePlan === FeaturePlan.LITE) {

throw new ValidationError('To enable choice-based authentication, set `featurePlan` to `FeaturePlan.ESSENTIALS` or `FeaturePlan.PLUS`.', this);

allowedFirstAuthFactors: { password: true } must allow Lite feature plan.

When the user have a user pool with choice-based authentication enabled and want to downgrade to Lite feature plan, the user must specify allowedFirstAuthFactors: { password: true } to disable choice-based authentication explicitly.
see #32369 (comment)

Tietew · 2025-02-04T09:17:41Z

@lpizzinidev Thank you for explanation. I misunderstood.

When Cognito supports to disable password authentication in the future,
the password option should default to false...

lpizzinidev

Thanks 👍

samson-keung

Appreciate the contribution! Thank you.

Left some comments on the design of the construct props.

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

Tietew · 2025-02-12T04:37:39Z

@samson-keung Than you for your review. I'm working on your suggestions.
Could you answer some questions I left, please?

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

samson-keung · 2025-02-12T18:00:22Z

@samson-keung Than you for your review. I'm working on your suggestions. Could you answer some questions I left, please?

Responded within the threads. Sorry I wasn't able to get to them quicker as I am in the PDT time zone. Updated my profile to reflect that :)

Co-authored-by: Samson Keung <keungsi@amazon.com>

Pull request has been modified.

Tietew · 2025-02-13T04:38:15Z

@samson-keung I pushed updates. Time zone is not an issue. Thank you!

samson-keung

LGTM. Thank you for adding this feature!

mergify · 2025-02-13T18:39:22Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-02-13T19:49:20Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: b8b00ef
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-02-13T19:49:38Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-02-13T19:49:49Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

github-actions bot added admired-contributor [Pilot] contributed between 13-24 PRs to the CDK effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Dec 3, 2024

aws-cdk-automation requested a review from a team December 3, 2024 06:47

This comment was marked as resolved.

Sign in to view

Tietew mentioned this pull request Dec 3, 2024

feat(cognito): user pool feature plans #32367

Merged

1 task

Tietew commented Dec 3, 2024

View reviewed changes

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Outdated Show resolved Hide resolved

Tietew added 5 commits December 6, 2024 13:05

feat: passwordless sign-in

d3e94df

integ test

9a5a230

check featurePlan

a6f16d8

emphasize *user* verification

3ce032f

update to refer choice-based authentication

53ffbfb

Tietew force-pushed the cognito-userpool-passwordless branch from 0d5449e to 53ffbfb Compare December 6, 2024 04:07

Tietew changed the title ~~feat(cognito): passwordless sign-in~~ feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) Dec 6, 2024

Merge branch 'main' into cognito-userpool-passwordless

5d22a32

Tietew marked this pull request as ready for review December 7, 2024 03:17

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 7, 2024

github-actions bot mentioned this pull request Jan 1, 2025

Monthly PR metrics report #32703

Closed

Merge branch 'main' into cognito-userpool-passwordless

9854255

lpizzinidev suggested changes Jan 28, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Show resolved Hide resolved

packages/aws-cdk-lib/aws-cognito/test/user-pool.test.ts Show resolved Hide resolved

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Outdated Show resolved Hide resolved

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 28, 2025

Tietew added 3 commits January 30, 2025 11:41

Merge branch 'main' into cognito-userpool-passwordless

c078c14

return undefined when no allowed factors

6b65ce0

validate length of passkeyRelyingPartyId

51468c7

eslint fix

3c1778b

lpizzinidev suggested changes Jan 31, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Outdated Show resolved Hide resolved

Tietew added 2 commits February 4, 2025 11:36

add explicit password auth factor

72501dc

add iteg test explicit disable choice-based authentication

92e1e11

lpizzinidev suggested changes Feb 4, 2025

View reviewed changes

Tietew added 2 commits February 4, 2025 19:06

require password: true always

b1a07b1

fix typo

9cf2814

lpizzinidev approved these changes Feb 8, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Feb 8, 2025

samson-keung self-assigned this Feb 10, 2025

samson-keung requested changes Feb 12, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Feb 12, 2025

samson-keung previously requested changes Feb 12, 2025

View reviewed changes

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Outdated Show resolved Hide resolved

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts Show resolved Hide resolved

Update packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

79e6c9a

Co-authored-by: Samson Keung <keungsi@amazon.com>

Tietew added 4 commits February 13, 2025 11:33

Merge branch 'main' into cognito-userpool-passwordless

b821f62

allowedFirstAuthFactors wrapped in signInPolicy

9df99ce

update doc

c2d1346

password is now mandatory to specify true

31b26cc

samson-keung approved these changes Feb 13, 2025

View reviewed changes

Merge branch 'main' into cognito-userpool-passwordless

b8b00ef

mergify bot merged commit 9a6e5cc into aws:main Feb 13, 2025
20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Feb 13, 2025

Tietew deleted the cognito-userpool-passwordless branch February 14, 2025 00:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Tietew commented Dec 3, 2024 •

edited

Loading

This comment was marked as resolved.

codecov bot commented Dec 3, 2024 •

edited

Loading

lpizzinidev left a comment

Tietew commented Jan 30, 2025

lpizzinidev left a comment

lpizzinidev Feb 4, 2025

Tietew Feb 4, 2025

Tietew commented Feb 4, 2025

lpizzinidev left a comment

samson-keung left a comment

Tietew commented Feb 12, 2025

samson-keung commented Feb 12, 2025

Tietew commented Feb 13, 2025

samson-keung left a comment

mergify bot commented Feb 13, 2025

aws-cdk-automation commented Feb 13, 2025

mergify bot commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Conversation

Tietew commented Dec 3, 2024 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

This comment was marked as resolved.

codecov bot commented Dec 3, 2024 • edited Loading

Codecov Report

lpizzinidev left a comment

Choose a reason for hiding this comment

Tietew commented Jan 30, 2025

lpizzinidev left a comment

Choose a reason for hiding this comment

lpizzinidev Feb 4, 2025

Choose a reason for hiding this comment

Tietew Feb 4, 2025

Choose a reason for hiding this comment

Tietew commented Feb 4, 2025

lpizzinidev left a comment

Choose a reason for hiding this comment

samson-keung left a comment

Choose a reason for hiding this comment

Tietew commented Feb 12, 2025

samson-keung commented Feb 12, 2025

Tietew commented Feb 13, 2025

samson-keung left a comment

Choose a reason for hiding this comment

mergify bot commented Feb 13, 2025

aws-cdk-automation commented Feb 13, 2025

AWS CodeBuild CI Report

mergify bot commented Feb 13, 2025

github-actions bot commented Feb 13, 2025

Tietew commented Dec 3, 2024 •

edited

Loading

codecov bot commented Dec 3, 2024 •

edited

Loading