feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Tietew · 2024-12-03T06:47:10Z

Issue # (if applicable)

Reason for this change

User Pool has introduced choice-based authentication, including passwordless sign-in and passkey (WebAuthn) sign-in.
For details, see Manage authentication methods in AWS SDKs.

Related PRs:

feat(cognito): user pool feature plans #32367 - requires Essentials or higher feature plan
feat(cognito): support for ALLOW_USER_AUTH explicit auth flow #32273 - requires User pool client to allow USER_AUTH auth flow

Description of changes

Added following properties:

allowedFirstAuthFactors - allowed first authenticate factors
passkeyRelyingPartyId - the authentication domain used as passkey relying party ID
passkeyUserVerification - configure user verification to be preferred or required

Description of how you validated changes

Added unit test and an integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Tietew · 2024-12-03T06:48:06Z

~~This PR is draft until #32367 is merged.~~ Ready now.

Tietew · 2024-12-03T06:50:41Z

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

+
+    // TODO: validate whether the feature plan is not Lite
+
+    const allowedFirstAuthFactors = ['PASSWORD'];


When 'PASSWORD' is missing, CloudFormations fails with following error:

Resource handler returned message: "Invalid request provided: PASSWORD should be configured as one of the allowed first auth factors."

codecov · 2024-12-03T06:59:39Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.79%. Comparing base (ccc9f5e) to head (3c1778b).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32369   +/-   ##
=======================================
  Coverage   80.79%   80.79%           
=======================================
  Files         232      232           
  Lines       14106    14106           
  Branches     2452     2452           
=======================================
  Hits        11397    11397           
  Misses       2429     2429           
  Partials      280      280

Flag	Coverage Δ
suite.unit	`80.79% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`79.53% <ø> (ø)`
packages/aws-cdk-lib/core	`82.17% <ø> (ø)`

### Issue # (if applicable) N/A ### Reason for this change Amazon Cognito introduces the feature plans which replaces the Advanced Security Mode. See: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-sign-in-feature-plans.html Related to #32369 - passwordless sign-in requires Essentials or higher feature plan. ### Description of changes - Add new `featurePlan` property and `FeaturePlan` enum to specify user pool feature plan. - Deprecate `advancedSecurityMode` property and `AdvancedSecurityMode` enum. Note that the previous AWS document about Advanced Security Mode is now redirected to [Advanced security with threat protection](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.html). ### Description of how you validated changes Added new unit tests and an integ test. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* --------- Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

lpizzinidev

👍 Sorry for the super-late review

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

lpizzinidev · 2025-01-28T18:17:17Z

packages/aws-cdk-lib/aws-cognito/test/user-pool.test.ts

@@ -5,7 +5,7 @@ import { Role, ServicePrincipal } from '../../aws-iam';
 import * as kms from '../../aws-kms';
 import * as lambda from '../../aws-lambda';
 import { CfnParameter, Duration, Stack, Tags } from '../../core';
-import { AccountRecovery, Mfa, NumberAttribute, StringAttribute, UserPool, UserPoolIdentityProvider, UserPoolOperation, VerificationEmailStyle, UserPoolEmail, AdvancedSecurityMode, LambdaVersion, FeaturePlan } from '../lib';
+import { AccountRecovery, Mfa, NumberAttribute, StringAttribute, UserPool, UserPoolIdentityProvider, UserPoolOperation, VerificationEmailStyle, UserPoolEmail, AdvancedSecurityMode, LambdaVersion, FeaturePlan, PasskeyUserVerification } from '../lib';


Is this line correctly formatted? 🤔

I think it's ok because eslint passes.

lpizzinidev · 2025-01-28T19:02:03Z

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

@@ -1322,6 +1388,28 @@ export class UserPool extends UserPoolBase {
    });
  }

+  private configureSignInPolicy(props: UserPoolProps): CfnUserPool.SignInPolicyProperty | undefined {
+    if (!props.allowedFirstAuthFactors) {


How should we handle allowedFirstAuthFactors: {}?
With the current implementation AllowedFirstAuthFactors: ['PASSWORD'] will be set explicitly by the CDK.
Maybe it's better to return undefined and let CFN handle the default?

I've updated to return undefined explicitly.

Tietew · 2025-01-30T03:23:51Z

@lpizzinidev Thank you for your comments! I've pushed some modifications.

lpizzinidev · 2025-01-31T14:47:35Z

packages/aws-cdk-lib/aws-cognito/lib/user-pool.ts

+    if (allowedFirstAuthFactors.length === 1) {
+      return undefined;
+    }


This could introduce subtle bugs in case the number of required auth methods changes for some reason.
Let's check !Object.keys(allowedFirstAuthFactors).length at L1417 instead.

Thank you for your suggestion.

But I'll revert this because:

Create a stack with a user pool including SignInPolicy: { AllowedFirstAuthFactors: ['PASSWORD','WEB_AUTHN'] }

Remove the SignInPolicy then update the stack

Management console shows the user pool still enables choice-based sign-in with Password and Passkey

Set SignInPolicy: { AllowedFirstAuthFactors: ['PASSWORD'] } then update the stack again

Management console shows the user pool disables choice-based sign-in.

Therefore, we should provide the way to disable choice-based sign-in explicitly by specifying allowedFirstAuthFactors: {}.

Similar issue: #30796

This reverts commit 6b65ce0.

aws-cdk-automation · 2025-02-03T03:24:20Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 69e8b8b
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

Tietew · 2025-02-03T03:24:54Z

@lpizzinidev
I've pushed the revert and an additional test for explicit allowedFirstAuthFactors: {}

github-actions bot added admired-contributor [Pilot] contributed between 13-24 PRs to the CDK effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Dec 3, 2024

aws-cdk-automation requested a review from a team December 3, 2024 06:47

Tietew mentioned this pull request Dec 3, 2024

feat(cognito): user pool feature plans #32367

Merged

1 task

Tietew commented Dec 3, 2024

View reviewed changes

Tietew added 5 commits December 6, 2024 13:05

feat: passwordless sign-in

d3e94df

integ test

9a5a230

check featurePlan

a6f16d8

emphasize *user* verification

3ce032f

update to refer choice-based authentication

53ffbfb

Tietew force-pushed the cognito-userpool-passwordless branch from 0d5449e to 53ffbfb Compare December 6, 2024 04:07

Tietew changed the title ~~feat(cognito): passwordless sign-in~~ feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) Dec 6, 2024

Merge branch 'main' into cognito-userpool-passwordless

5d22a32

Tietew marked this pull request as ready for review December 7, 2024 03:17

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 7, 2024

github-actions bot mentioned this pull request Jan 1, 2025

Monthly PR metrics report #32703

Open

Merge branch 'main' into cognito-userpool-passwordless

9854255

lpizzinidev suggested changes Jan 28, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 28, 2025

Tietew added 3 commits January 30, 2025 11:41

Merge branch 'main' into cognito-userpool-passwordless

c078c14

return undefined when no allowed factors

6b65ce0

validate length of passkeyRelyingPartyId

51468c7

eslint fix

3c1778b

lpizzinidev suggested changes Jan 31, 2025

View reviewed changes

Tietew added 4 commits February 3, 2025 11:11

Merge branch 'main' into cognito-userpool-passwordless

ff2de74

Revert "return undefined when no allowed factors"

882cf41

This reverts commit 6b65ce0.

test explicit blank

27eb274

choice-based authentication

69e8b8b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Tietew commented Dec 3, 2024 •

edited

Loading

Tietew commented Dec 3, 2024 •

edited

Loading

Tietew Dec 3, 2024

codecov bot commented Dec 3, 2024 •

edited

Loading

lpizzinidev left a comment

lpizzinidev Jan 28, 2025

Tietew Jan 30, 2025

lpizzinidev Jan 28, 2025

Tietew Jan 30, 2025

Tietew commented Jan 30, 2025

lpizzinidev Jan 31, 2025

Tietew Feb 3, 2025 •

edited

Loading

Tietew Feb 3, 2025

aws-cdk-automation commented Feb 3, 2025

Tietew commented Feb 3, 2025


		// TODO: validate whether the feature plan is not Lite

		const allowedFirstAuthFactors = ['PASSWORD'];

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Are you sure you want to change the base?

feat(cognito): choice-based authentication (passwordless sign-in / passkey sign-in) #32369

Conversation

Tietew commented Dec 3, 2024 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

Tietew commented Dec 3, 2024 • edited Loading

Tietew Dec 3, 2024

Choose a reason for hiding this comment

codecov bot commented Dec 3, 2024 • edited Loading

Codecov Report

lpizzinidev left a comment

Choose a reason for hiding this comment

lpizzinidev Jan 28, 2025

Choose a reason for hiding this comment

Tietew Jan 30, 2025

Choose a reason for hiding this comment

lpizzinidev Jan 28, 2025

Choose a reason for hiding this comment

Tietew Jan 30, 2025

Choose a reason for hiding this comment

Tietew commented Jan 30, 2025

lpizzinidev Jan 31, 2025

Choose a reason for hiding this comment

Tietew Feb 3, 2025 • edited Loading

Choose a reason for hiding this comment

Tietew Feb 3, 2025

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 3, 2025

AWS CodeBuild CI Report

Tietew commented Feb 3, 2025

Tietew commented Dec 3, 2024 •

edited

Loading

Tietew commented Dec 3, 2024 •

edited

Loading

codecov bot commented Dec 3, 2024 •

edited

Loading

Tietew Feb 3, 2025 •

edited

Loading