Cognito Email MFA Setup

I apologize for the confusion you're experiencing with the Email MFA setup in Amazon Cognito. Based on the information provided, it seems that there might be a few things to consider:

1. Ensure that the advanced security features are active in your user pool. Email MFA requires these features to be enabled.

2. Verify that your user pool is configured to use Amazon SES for sending emails instead of the default email configuration. This is a requirement for email MFA to function properly.

3. Double-check that the USERNAME provided in the ChallengeResponses is correct and matches exactly with the user's username in the user pool.

4. Make sure that the ClientId you're using is correct and associated with the user pool where the user exists.

5. Confirm that the Session token you're passing is valid and hasn't expired. The MFA code is only valid for the duration of the authentication flow session, which is set in your app client settings.

6. Ensure that you're using the correct API endpoint for your region (the example shows us-east-1, make sure this matches your user pool's region).

If all of these aspects are correct, the issue might be related to how the user's email attribute is set up or how the email MFA is configured for the specific user. You might want to check the user's attributes in the user pool to ensure the email is correctly associated and that MFA settings are properly configured for the user.

If the problem persists after verifying these points, you may need to contact AWS support for further assistance, as this behavior seems unexpected given that the user exists and the MFA code was successfully sent and verified according to the user event history.
Sources
Email MFA - Amazon Cognito
SMS and email message MFA - Amazon Cognito
SetUserMFAPreference - Amazon Cognito User Pools

Hello,

Based on your case notes,I understand that you're experiencing issues with the Email MFA setup in Amazon Cognito.

To troubleshoot the "UserNotFoundException" error when attempting to set up email MFA for a Cognito user, you can try the following steps:

1. Verify that the user account exists and is in an active state by checking the Cognito user pool using the AWS Management Console or the AWS CLI command "admin-get-user".
2. Ensure that the user's email address is verified. If the user account was created by an administrator, the email may need to be explicitly marked as verified using the "admin-update-user-attributes" CLI command: aws cognito-idp admin-update-user-attributes --user-pool-id <user-pool-id> --username <email> --user-attributes Name="email_verified",Value="true"
3. If the user account exists and the email is verified, try using the "SelectMFAType" method before attempting to set up email MFA, as suggested in . This method allows the user to choose their preferred MFA type (email or TOTP), which may be required for email MFA to work correctly.
4. Check the Amazon SES logs to verify if Cognito is successfully sending emails to the user's email address. If emails are not being delivered, there may be an issue with the email configuration or deliverability.
5. Ensure that the advanced security features are active in your user pool. Email MFA requires these features to be enabled.
6. Double-check that the USERNAME provided in the ChallengeResponses is correct and matches exactly with the user's username in the user pool.
7. Make sure that the ClientId you're using is correct and associated with the user pool where the user exists.
8. Confirm that the Session token you're passing is valid and hasn't expired. The MFA code is only valid for the duration of the authentication flow session, which is set in your app client settings.
9. Ensure that you're using the correct API endpoint for your region (the example shows us-east-1, make sure this matches your user pool's region).

If all of these aspects are correct, the issue might be related to how the user's email attribute is set up or how the email MFA is configured for the specific user. You might want to check the user's attributes in the user pool to ensure the email is correctly associated and that MFA settings are properly configured for the user.

If the above steps do not resolve the issue, you may need to enable more detailed logging or reach out to AWS Support for further assistance in debugging the specific error.

Reference

[+]https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.html

[+]https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa-sms-email-message.html

[+]https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security-email-mfa.html

Hello,

Yeah, it turns out that the value I was using for the username field in the response challenge call was not the one expected. In our users pool we use the user's email address as the username, so was using that value. But it looks like the API expects the user sub's value here.

The confusion I got is because the error message was not inline with the log in the user's event history.

Finally this is solved: use the user's sub value as the value of the username field when calling the respond auth challenge.

Thanks.