admin-initiate-auth with AWS CLI on a Cognito App-client with a secret

Question

I'm trying to use the AWS CLI to confirm Cognito users (to change their status from FORCE_CHANGE_PASSWORD to CONFIRMED). I had success doing this with an App client without and app secret, but I can't figure out how to do it in an App client that has one. According to the AWS CLI reference, here:

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/admin-initiate-auth.html

I should be able to do it by passing the App secret, like this:

(broken up for formatting, I'm entering it as a full line)

aws cognito-idp admin-initiate-auth 
    --user-pool-id us-east-1_xxxxxxxx 
    --region=us-east-1 
    --client-id xxxxxxxxxxxxxxxxxxxxx
    --auth-flow ADMIN_NO_SRP_AUTH
    --auth-parameters
        USERNAME=TestUser
        PASSWORD='Test_Password'
        SECRET_HASH=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx 
    --profile AwsProfile

I took the secret value from the App client secret field on the web console, and I enabled "Enable sign-in API for server-based authentication (ADMIN_NO_SRP_AUTH)" too.

However, I keep getting this response: An error occurred (NotAuthorizedException) when calling the AdminInitiateAuth operation: Unable to verify secret hash for client xxxxxxxxxxxxxxxxxxxxxxx

What could I be doing wrong?

What is the SECRET_HASH value that you are passing? It should be a MAC of user-id and client-id signed in client secret key with HmacSHA256 and encoded in Base64. — Deepthi
No, I assumed I just needed the "App Secret" provided by Cognito. How can I know if I need this HmacSHA256 hash? Can you point to somewhere in the docs? — Pablo Barría Urenda
Yes: docs.amazonaws.cn/en_us/cognito/latest/developerguide/… — Deepthi

Deepthi Deepthi · Accepted Answer · 2018-11-23T09:29:22

Compute your SECRET_HASH as follows:

Base64 ( HMAC_SHA256 ( "Client Secret Key", "Username" + "Client Id" ) )

Ref: https://docs.amazonaws.cn/en_us/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash

admin-initiate-auth with AWS CLI on a Cognito App-client with a secret

1 Answers