Amazon web services 如何更改用户状态强制更改密码？
使用AWS Cognito，我想为测试目的创建虚拟用户 然后我使用AWS控制台创建这样的用户，但该用户的状态设置为Amazon web services 如何更改用户状态强制更改密码？,amazon-web-services,aws-cli,amazon-cognito,Amazon Web Services,Aws Cli,Amazon Cognito,使用AWS Cognito，我想为测试目的创建虚拟用户 然后我使用AWS控制台创建这样的用户，但该用户的状态设置为FORCE\u CHANGE\u PASSWORD。使用该值，无法对该用户进行身份验证 有没有办法改变这种状态 更新 从CLI创建用户时的行为与此相同很抱歉，您遇到了困难。我们没有一个一步流程，您可以直接创建用户并对其进行身份验证。我们将来可能会对此进行更改，例如允许管理员设置用户可以直接使用的密码。目前，当您使用AdminCreateUser或通过向用户注册应用程序来创建用户时，需
FORCE\u CHANGE\u PASSWORD从CLI创建用户时的行为与此相同很抱歉，您遇到了困难。我们没有一个一步流程，您可以直接创建用户并对其进行身份验证。我们将来可能会对此进行更改，例如允许管理员设置用户可以直接使用的密码。目前，当您使用
AdminCreateUserrespondToAuthChallenge（）强制更改密码var参数={
ChallengeName:“需要新密码”，
客户ID:“你自己的3J6…0obh”，
挑战者响应：{
用户名：“user3”，
新密码：“已更改12345”
},
会话：“XXXXXXXXX ZDMCRU-5u…sCvrmZb6tHY”
};
cognitoidentityserviceprovider.respondToAuthChallenge（参数，函数（错误，数据）{
if（err）console.log（err，err.stack）；//发生错误
else console.log（数据）；//响应成功
});
user3CONFIRMED我知道这已经有一段时间了，但我想这可能会帮助其他看到这篇文章的人 您可以使用AWS CLI更改用户密码，但这是一个多步骤过程：
步骤1:获取所需用户的会话令牌：
aws cognito idp admin initiate auth--用户池id%用户池id%--客户端id%应用程序客户端id%--身份验证流管理\u NO\u SRP\u auth--身份验证参数用户名=%USERS用户名%，密码=%USERS当前密码%
无法验证客户端的机密哈希的错误，创建另一个没有机密的应用程序客户端，并使用该客户端ID
步骤2:如果步骤1成功，它将使用质询所需的新密码
、其他质询参数和用户会话密钥进行响应。然后，您可以运行第二个命令来发出质询响应：
aws cognito idp admin响应身份验证质询--用户池id%用户池id%--客户端id%客户端id%--质询名称新密码\u必需--质询响应新密码=%所需密码%，用户名=%USERS USERNAME%--会话%session密钥来自上一个命令和“”%
如果您得到一个关于给定的无效属性的错误，XXX将丢失
使用格式userAttributes传递丢失的属性。$FIELD\u NAME=$VALUE
上述命令应返回有效的身份验证结果和适当的令牌
重要提示：要使此功能正常工作，Cognito用户池必须有一个配置了ADMIN\u NO\u SRP\u AUTH
功能的应用客户端（中的步骤5）。确定。我终于有了管理员可以创建新用户的代码。过程如下：
管理员创建用户
用户收到带有临时密码的电子邮件
用户登录并被要求更改其密码
第一步是最难的部分。以下是我在Node JS中创建用户的代码：
let params = {
UserPoolId: "@cognito_pool_id@",
Username: username,
DesiredDeliveryMediums: ["EMAIL"],
ForceAliasCreation: false,
UserAttributes: [
{ Name: "given_name", Value: firstName },
{ Name: "family_name", Value: lastName},
{ Name: "name", Value: firstName + " " + lastName},
{ Name: "email", Value: email},
{ Name: "custom:title", Value: title},
{ Name: "custom:company", Value: company + ""}
],
};
let cognitoIdentityServiceProvider = new AWS.CognitoIdentityServiceProvider();
cognitoIdentityServiceProvider.adminCreateUser(params, function(error, data) {
if (error) {
console.log("Error adding user to cognito: " + error, error.stack);
reject(error);
} else {
// Uncomment for interesting but verbose logging...
//console.log("Received back from cognito: " + CommonUtils.stringify(data));
cognitoIdentityServiceProvider.adminUpdateUserAttributes({
UserAttributes: [{
Name: "email_verified",
Value: "true"
}],
UserPoolId: "@cognito_pool_id@",
Username: username
}, function(err) {
if (err) {
console.log(err, err.stack);
} else {
console.log("Success!");
resolve(data);
}
});
}
});
基本上，您需要发送第二个命令来强制电子邮件被视为已验证。用户仍然需要转到他们的电子邮件以获取临时密码（这也会验证电子邮件）。但是，如果没有第二个将电子邮件设置为“已验证”的呼叫，您将无法获得重置密码的正确呼叫。只需在登录函数中的onSuccess:function（result）{…}，
之后添加此代码即可。然后，您的用户的状态将为“已确认”
newPasswordRequired: function(userAttributes, requiredAttributes) {
// User was signed up by an admin and must provide new
// password and required attributes, if any, to complete
// authentication.
// the api doesn't accept this field back
delete userAttributes.email_verified;
// unsure about this field, but I don't send this back
delete userAttributes.phone_number_verified;
// Get these details and call
cognitoUser.completeNewPasswordChallenge(newPassword, userAttributes, this);
}
更新：
已经有一些更新，不再需要Amplify client。
在adminCreateUser（）之后，您现在可以使用
cisp.adminSetUserPassword({
UserPoolId: pool_id,
Username: login,
Password: password,
Permanent: true
})
[https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html]
这将用户设置为“已确认”
更新：
我现在在一个NodeJS Lambda中使用这个，翻译成放大：
// enable node-fetch polyfill for Node.js
global.fetch = require("node-fetch").default;
global.navigator = {};
const AWS = require("aws-sdk");
const cisp = new AWS.CognitoIdentityServiceProvider();
const Amplify = require("@aws-amplify/core").default;
const Auth = require("@aws-amplify/auth").default;
...
/*
this_user: {
given_name: string,
password: string,
email: string,
cell: string
}
*/
const create_cognito = (this_user) => {
let this_defaults = {
password_temp: Math.random().toString(36).slice(-8),
password: this_user.password,
region: global._env === "prod" ? production_region : development_region,
UserPoolId:
global._env === "prod"
? production_user_pool
: development_user_pool,
ClientId:
global._env === "prod"
? production_client_id
: development_client_id,
given_name: this_user.given_name,
email: this_user.email,
cell: this_user.cell,
};
// configure Amplify
Amplify.configure({
Auth: {
region: this_defaults.region,
userPoolId: this_defaults.UserPoolId,
userPoolWebClientId: this_defaults.ClientId,
},
});
if (!Auth.configure())
return Promise.reject("could not configure amplify");
return new Promise((resolve, reject) => {
let _result = {};
let this_account = undefined;
let this_account_details = undefined;
// create cognito account
cisp
.adminCreateUser({
UserPoolId: this_defaults.UserPoolId,
Username: this_defaults.given_name,
DesiredDeliveryMediums: ["EMAIL"],
ForceAliasCreation: false,
MessageAction: "SUPPRESS",
TemporaryPassword: this_defaults.password_temp,
UserAttributes: [
{ Name: "given_name", Value: this_defaults.given_name },
{ Name: "email", Value: this_defaults.email },
{ Name: "phone_number", Value: this_defaults.cell },
{ Name: "email_verified", Value: "true" },
],
})
.promise()
.then((user) => {
console.warn(".. create_cognito: create..");
_result.username = user.User.Username;
_result.temporaryPassword = this_defaults.password_temp;
_result.password = this_defaults.password;
// sign into cognito account
return Auth.signIn(_result.username, _result.temporaryPassword);
})
.then((user) => {
console.warn(".. create_cognito: signin..");
// complete challenge
return Auth.completeNewPassword(user, _result.password, {
email: this_defaults.email,
phone_number: this_defaults.cell,
});
})
.then((user) => {
console.warn(".. create_cognito: confirmed..");
this_account = user;
// get details
return Auth.currentAuthenticatedUser();
})
.then((this_details) => {
if (!(this_details && this_details.attributes))
throw "account creation failes";
this_account_details = Object.assign({}, this_details.attributes);
// signout
return this_account.signOut();
})
.then(() => {
console.warn(".. create_cognito: complete");
resolve(this_account_details);
})
.catch((err) => {
console.error(".. create_cognito: error");
console.error(err);
reject(err);
});
});
};
我正在设置临时密码，然后将其重置为用户请求的密码
旧职位：
您可以使用amazon cognito identity js SDK解决此问题，方法是在使用CognitoIdentityService Provider.adminCreateUser（）
创建帐户后使用临时密码进行身份验证，并在cognitoUser.authenticateUser（，{newPasswordRequired}）中运行cognitoUser.completeNewPasswordChallenge（）
-所有这些都在创建用户的函数中
我在AWS lambda中使用以下代码创建启用的Cognito用户帐户。我相信它可以优化，请耐心等待。这是我的第一篇文章，我对JavaScript还是相当陌生的
var AWS = require("aws-sdk");
var AWSCognito = require("amazon-cognito-identity-js");
var params = {
UserPoolId: your_poolId,
Username: your_username,
DesiredDeliveryMediums: ["EMAIL"],
ForceAliasCreation: false,
MessageAction: "SUPPRESS",
TemporaryPassword: your_temporaryPassword,
UserAttributes: [
{ Name: "given_name", Value: your_given_name },
{ Name: "email", Value: your_email },
{ Name: "phone_number", Value: your_phone_number },
{ Name: "email_verified", Value: "true" }
]
};
var cognitoidentityserviceprovider = new AWS.CognitoIdentityServiceProvider();
let promise = new Promise((resolve, reject) => {
cognitoidentityserviceprovider.adminCreateUser(params, function(err, data) {
if (err) {
reject(err);
} else {
resolve(data);
}
});
});
promise
.then(data => {
// login as new user and completeNewPasswordChallenge
var anotherPromise = new Promise((resolve, reject) => {
var authenticationDetails = new AWSCognito.AuthenticationDetails({
Username: your_username,
Password: your_temporaryPassword
});
var poolData = {
UserPoolId: your_poolId,
ClientId: your_clientId
};
var userPool = new AWSCognito.CognitoUserPool(poolData);
var userData = {
Username: your_username,
Pool: userPool
};
var cognitoUser = new AWSCognito.CognitoUser(userData);
let finalPromise = new Promise((resolve, reject) => {
cognitoUser.authenticateUser(authenticationDetails, {
onSuccess: function(authResult) {
cognitoUser.getSession(function(err) {
if (err) {
} else {
cognitoUser.getUserAttributes(function(
err,
attResult
) {
if (err) {
} else {
resolve(authResult);
}
});
}
});
},
onFailure: function(err) {
reject(err);
},
newPasswordRequired(userAttributes, []) {
delete userAttributes.email_verified;
cognitoUser.completeNewPasswordChallenge(
your_newPoassword,
userAttributes,
this
);
}
});
});
finalPromise
.then(finalResult => {
// signout
cognitoUser.signOut();
// further action, e.g. email to new user
resolve(finalResult);
})
.catch(err => {
reject(err);
});
});
return anotherPromise;
})
.then(() => {
resolve(finalResult);
})
.catch(err => {
reject({ statusCode: 406, error: err });
});
对于Java SDK，假设您的Cognito客户端已安装，并且您的用户处于强制更改密码状态，您可以执行以下操作来确认您的用户。。。然后像平常一样认证
AdminCreateUserResult createUserResult = COGNITO_CLIENT.adminCreateUser(createUserRequest());
AdminInitiateAuthResult authResult = COGNITO_CLIENT.adminInitiateAuth(authUserRequest());
Map<String,String> challengeResponses = new HashMap<>();
challengeResponses.put("USERNAME", USERNAME);
challengeResponses.put("NEW_PASSWORD", PASSWORD);
RespondToAuthChallengeRequest respondToAuthChallengeRequest = new RespondToAuthChallengeRequest()
.withChallengeName("NEW_PASSWORD_REQUIRED")
.withClientId(CLIENT_ID)
.withChallengeResponses(challengeResponses)
.withSession(authResult.getSession());
COGNITO_CLIENT.respondToAuthChallenge(respondToAuthChallengeRequest);
AdminCreateUserResult=COGNITO_CLIENT.adminCreateUser（createUserRequest（））；
AdminInitiateAuthResult=COGNITO_CLIENT.adminInitiateAuth（authUserRequest（））；
Map challengeResponses=new HashMap（）；
challengeResponses.put（“用户名”，USERNAME）；
challengeResponses.put（“新密码”，PASSWORD）；
RespondToAuthChallengeRequest RespondToAuthChallengeRequest=新建RespondToAuthChallengeRequest（）
.withChallengeName（“需要新密码”）
.withClientId
aws cognito-idp sign-up \
--region %aws_project_region% \
--client-id %aws_user_pools_web_client_id% \
--username %email_address% \
--password %password% \
--user-attributes Name=email,Value=%email_address%
aws cognito-idp admin-confirm-sign-up \
--user-pool-id %aws_user_pools_web_client_id% \
--username %email_address%
public class User
{
public string Username { get; set; }
public string Password { get; set; }
}
public void AddUser(User user)
{
var tempPassword = "ANY";
var request = new AdminCreateUserRequest()
{
Username = user.Username,
UserPoolId = "MyuserPoolId",
TemporaryPassword = tempPassword
};
var result = _cognitoClient.AdminCreateUserAsync(request).Result;
var authResponse = _cognitoClient.AdminInitiateAuthAsync(new AdminInitiateAuthRequest()
{
UserPoolId = "MyuserPoolId",
ClientId = "MyClientId",
AuthFlow = AuthFlowType.ADMIN_NO_SRP_AUTH,
AuthParameters = new Dictionary<string, string>()
{
{"USERNAME",user.Username },
{"PASSWORD", tempPassword}
}
}).Result;
_cognitoClient.RespondToAuthChallengeAsync(new RespondToAuthChallengeRequest()
{
ClientId = "MyClientId",
ChallengeName = ChallengeNameType.NEW_PASSWORD_REQUIRED,
ChallengeResponses = new Dictionary<string, string>()
{
{"USERNAME",user.Username },
{"NEW_PASSWORD",user.Password }
},
Session = authResponse.Session
});
}
func sessionWithDefaultRegion(region string) *session.Session {
sess := Session.Copy()
if v := aws.StringValue(sess.Config.Region); len(v) == 0 {
sess.Config.Region = aws.String(region)
}
return sess
}
func (c *CognitoAppClient) ChangePassword(userName, currentPassword, newPassword string) error {
sess := sessionWithDefaultRegion(c.Region)
svc := cognitoidentityprovider.New(sess)
auth, err := svc.AdminInitiateAuth(&cognitoidentityprovider.AdminInitiateAuthInput{
UserPoolId:aws.String(c.UserPoolID),
ClientId:aws.String(c.ClientID),
AuthFlow:aws.String("ADMIN_NO_SRP_AUTH"),
AuthParameters: map[string]*string{
"USERNAME": aws.String(userName),
"PASSWORD": aws.String(currentPassword),
},
})
if err != nil {
return err
}
request := &cognitoidentityprovider.AdminRespondToAuthChallengeInput{
ChallengeName: aws.String("NEW_PASSWORD_REQUIRED"),
ClientId:aws.String(c.ClientID),
UserPoolId: aws.String(c.UserPoolID),
ChallengeResponses:map[string]*string{
"USERNAME":aws.String(userName),
"NEW_PASSWORD": aws.String(newPassword),
},
Session:auth.Session,
}
_, err = svc.AdminRespondToAuthChallenge(request)
return err
}
import (
"fmt"
"github.com/aws/aws-sdk-go/service/cognitoidentityprovider"
. "github.com/smartystreets/goconvey/convey"
"testing"
)
func TestCognitoAppClient_ChangePassword(t *testing.T) {
Convey("Testing ChangePassword!", t, func() {
err := client.ChangePassword("user_name_here", "current_pass", "new_pass")
Convey("Testing ChangePassword Results!", func() {
So(err, ShouldBeNil)
})
})
}
$ > go-cognito-authy --profile cloudy -region eu-central-1 admin reset-pass --username rafpe --pass-new 'Password.0ne2!' --clientID 2jxxxiuui123 --userPoolID eu-central-1_CWNnTiR0j --session "bCqSkLeoJR_ys...."