admin-initiate-auth with AWS CLI on a Cognito App-client with a secret

I'm trying to use the AWS CLI to confirm Cognito users (to change their status from FORCE_CHANGE_PASSWORD to CONFIRMED). I had success doing this with an App client without and app secret, but I can't figure out how to do it in an App client that has one. According to the AWS CLI reference, here:

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-initiate-auth.html

I should be able to do it by passing the App secret, like this:

(broken up for formatting, I'm entering it as a full line)

aws cognito-idp admin-initiate-auth 

    --user-pool-id us-east-1_xxxxxxxx 

    --region=us-east-1 

    --client-id xxxxxxxxxxxxxxxxxxxxx

    --auth-flow ADMIN_NO_SRP_AUTH

    --auth-parameters

        USERNAME=TestUser

        PASSWORD='Test_Password'

        SECRET_HASH=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 

    --profile AwsProfile

I took the secret value from the App client secret field on the web console, and I enabled "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" too.

However, I keep getting this response:
An error occurred (NotAuthorizedException) when calling the AdminInitiateAuth operation: Unable to verify secret hash for client xxxxxxxxxxxxxxxxxxxxxxx

What could I be doing wrong?

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64.

– Deepthi
Nov 22 '18 at 10:35

No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs?

– Pablo Barría Urenda
Nov 22 '18 at 16:30

Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/…

– Deepthi
Nov 23 '18 at 9:28

add a comment |

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-initiate-auth.html

I should be able to do it by passing the App secret, like this:

(broken up for formatting, I'm entering it as a full line)

aws cognito-idp admin-initiate-auth 

    --user-pool-id us-east-1_xxxxxxxx 

    --region=us-east-1 

    --client-id xxxxxxxxxxxxxxxxxxxxx

    --auth-flow ADMIN_NO_SRP_AUTH

    --auth-parameters

        USERNAME=TestUser

        PASSWORD='Test_Password'

        SECRET_HASH=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 

    --profile AwsProfile

I took the secret value from the App client secret field on the web console, and I enabled "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" too.

However, I keep getting this response:
An error occurred (NotAuthorizedException) when calling the AdminInitiateAuth operation: Unable to verify secret hash for client xxxxxxxxxxxxxxxxxxxxxxx

What could I be doing wrong?

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64.

– Deepthi
Nov 22 '18 at 10:35

No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs?

– Pablo Barría Urenda
Nov 22 '18 at 16:30

Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/…

– Deepthi
Nov 23 '18 at 9:28

add a comment |

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-initiate-auth.html

I should be able to do it by passing the App secret, like this:

(broken up for formatting, I'm entering it as a full line)

aws cognito-idp admin-initiate-auth 

    --user-pool-id us-east-1_xxxxxxxx 

    --region=us-east-1 

    --client-id xxxxxxxxxxxxxxxxxxxxx

    --auth-flow ADMIN_NO_SRP_AUTH

    --auth-parameters

        USERNAME=TestUser

        PASSWORD='Test_Password'

        SECRET_HASH=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 

    --profile AwsProfile

I took the secret value from the App client secret field on the web console, and I enabled "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" too.

However, I keep getting this response:
An error occurred (NotAuthorizedException) when calling the AdminInitiateAuth operation: Unable to verify secret hash for client xxxxxxxxxxxxxxxxxxxxxxx

What could I be doing wrong?

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-initiate-auth.html

I should be able to do it by passing the App secret, like this:

(broken up for formatting, I'm entering it as a full line)

aws cognito-idp admin-initiate-auth 

    --user-pool-id us-east-1_xxxxxxxx 

    --region=us-east-1 

    --client-id xxxxxxxxxxxxxxxxxxxxx

    --auth-flow ADMIN_NO_SRP_AUTH

    --auth-parameters

        USERNAME=TestUser

        PASSWORD='Test_Password'

        SECRET_HASH=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 

    --profile AwsProfile

I took the secret value from the App client secret field on the web console, and I enabled "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" too.

However, I keep getting this response:
An error occurred (NotAuthorizedException) when calling the AdminInitiateAuth operation: Unable to verify secret hash for client xxxxxxxxxxxxxxxxxxxxxxx

What could I be doing wrong?

amazon-web-services amazon-cognito aws-cli

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

asked Nov 21 '18 at 13:26

Pablo Barría Urenda

2,18241120

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64.

– Deepthi
Nov 22 '18 at 10:35

No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs?

– Pablo Barría Urenda
Nov 22 '18 at 16:30

Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/…

– Deepthi
Nov 23 '18 at 9:28

add a comment |

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64.

– Deepthi
Nov 22 '18 at 10:35

No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs?

– Pablo Barría Urenda
Nov 22 '18 at 16:30

Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/…

– Deepthi
Nov 23 '18 at 9:28

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64.

– Deepthi
Nov 22 '18 at 10:35

No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs?

– Pablo Barría Urenda
Nov 22 '18 at 16:30

Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/…

– Deepthi
Nov 23 '18 at 9:28

add a comment |

1 Answer
1

active

oldest

votes

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" )
)

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

answered Nov 23 '18 at 9:29

Deepthi

15218

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53413080%2fadmin-initiate-auth-with-aws-cli-on-a-cognito-app-client-with-a-secret%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" )
)

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

answered Nov 23 '18 at 9:29

Deepthi

15218

add a comment |

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" )
)

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

answered Nov 23 '18 at 9:29

Deepthi

15218

add a comment |

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" )
)

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

answered Nov 23 '18 at 9:29

Deepthi

15218

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" )
)

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

answered Nov 23 '18 at 9:29

Deepthi

15218

answered Nov 23 '18 at 9:29

Deepthi

15218

answered Nov 23 '18 at 9:29

Deepthi

15218

answered Nov 23 '18 at 9:29

Deepthi

15218

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Agfdhyk