Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Cognito managed login issues

0

Hi,

I am trying to deploy Cognito using the managed login.

I may miss something, Cognito as IDP support onboarding of users but it seems that after onboard no self service is available.

I am looking for the following:

  1. Change first name/last name.
  2. Change email.
  3. Change password - not available - user can only reset password "aka using forget", once this is not true that he forget.
  4. Change MFA (authenticator) - user switches a phone needs to install a new authenticator, there is no option to do that, I did see [1] but this requires admin attention[1] and exposes the user for a period in which he is not protected.

I would expect that Cognito managed login will also have <domain>/account endpoint to allow user manage the Cognito related attributes, aka modify attributes, email, change password, change authenticator. Most IDPs support this.

I also could not activate MFA + Passkey, aka a user authenticates using MFA then prompted to enroll his Passkey, it works in Google for example...

I selected the following but user is not prompted to enter passkey.

  • Require MFA - Recommented
  • Passkey/User verification/Preferred "Your user pool UI encourages users to select a passkey type that supports user verification. In user verification, the passkey authenticator confirms that the user is authorized."

I also selected Device tracking/User opt-in "Users can choose to remember their device history." and user is not prompted to choose to trust the device.

What am I missing?

Thanks, Alon

[1] https://repost.aws/questions/QUqF6izZFoRRy9QoWbdN2rww/cognito-mfa-reset-or-reconfigure-for-user

Topics
Security, Identity, & Compliance
Tags
Amazon CognitoAmazon Cognito User Pools
Language
English

asked a year ago624 views

1 Answer
0

It appears you're encountering several limitations with Amazon Cognito's Managed Login feature. Let's address your concerns one by one:

  1. Changing first name/last name: Currently, Cognito's Managed Login doesn't provide a built-in self-service option for users to change their profile information like first and last names.

  2. Changing email: Similar to names, there's no self-service option for users to change their email addresses through the Managed Login interface.

  3. Changing password: You're correct that the standard option is to use the "Forgot Password" flow. There isn't a dedicated "Change Password" feature in the Managed Login UI.

  4. Changing MFA (authenticator): The Managed Login doesn't offer a self-service option for users to change their MFA method or set up a new authenticator.

Regarding your expectation of a /account endpoint for users to manage their Cognito-related attributes, unfortunately, this isn't a feature of the Managed Login. The Managed Login provides a standardized authentication experience with limited customization options.

For the Passkey and MFA issues:

  • The Passkey feature might not be working as expected if you've upgraded an existing user pool from an older plan to the Essentials plan. In some cases, even after enabling Passkeys, they may not be offered as a login option for existing users.

  • The MFA + Passkey combination you're looking for (authenticating with MFA then enrolling a Passkey) isn't a standard flow in Cognito's Managed Login.

  • The device tracking/User opt-in feature not prompting users to trust their device could be related to how the feature is implemented in the Managed Login UI.

To address these limitations, you might need to consider implementing a custom authentication UI or using the Amazon Cognito API directly to create the user management features you need. This would give you more control over the authentication process and user management options.

If these features are crucial for your application, you may want to reach out to AWS support for further guidance or to suggest these as potential improvements to the Managed Login feature.

Sources
Cognito Managed Login - No button on login page for external IDP | AWS re:Post
Cognito Managed Login doesn't seem to support login_hint | AWS re:Post
Displaying error message in Cognito managed login sign-in page | AWS re:Post
Cognito pool migration legacy/lite to essentials - passkeys not working | AWS re:Post

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content