Password verification in a CUSTOM_AUTH flow, do you need to handle SRP yourself?

If I want to verify a username and password, AND go through the custom auth flow, would I need to implement SRP myself? i.e. generate SRP_A and calculate PASSWORD_CLAIM_SIGNATURE

Is there no way to bypass these SRP calculations / Is there no function to do these calculations for me?

주제

보안, 신원 및 규정 준수

태그

아마존 Cognito

언어

English

SimonM

질문됨 2년 전222회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

이 답변이 도움이 되었나요?커뮤니티가 여러분의 지식을 활용할 수 있도록 정답을 찬성하세요.

Hi,

It's possible to use the SRP flow if you use it before dropping into the custom challenges. This blog shows the process specifically with Duo but you could replace the custom challenges with your own.

Thanks, Owen

Owen

답변함 2년 전

SimonM
2년 전
Oh, I'm trying to avoid SRP. I want to validate the users password/credentials and go through the CUSTOM_AUTH flow, but I don't want to have to work out SRP_A and PASSWORD_CLAIM_SIGNATURE

So far it seems like SRP_A and PASSWORD_CLAIM_SIGNATURE are unavoidable if I want to validate username and passwords with CUSTOM_AUTH flow

Password verification in a CUSTOM_AUTH flow, do you need to handle SRP yourself?

관련 콘텐츠