How to programmatically enable or disable MFA for a logged user in AWS Cognito user pool in Java?

Question

I am using the following code, but it doesn't change anything in the AWS, although it returns nothing as stated in the documentation. https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.html

public boolean changeMfaStatus(String username, Boolean status) {
    final SMSMfaSettingsType smsMfaSettings = SMSMfaSettingsType.builder()
            .preferredMfa(true)
            .enabled(true)
            .build();
    final AdminSetUserMfaPreferenceRequest setUserMFAPreferenceRequest = AdminSetUserMfaPreferenceRequest.builder()
            .userPoolId(userPoolID)
            .smsMfaSettings(smsMfaSettings)
            .username(username)
            .build();
    LOG.warn(setUserMFAPreferenceRequest);
    try {
        cognitoClient.adminSetUserMFAPreference(setUserMFAPreferenceRequest);
    } catch (Exception e) {
        LOG.warn(e);
        return false;
    }
    return true;
}

Update: Actually, this code changes the SMS MFA Status, but the changes cannot be seen in the UI of the Cognito user pool. As the same thing from aws-cli also changes the status, but not in UI.

Update-0: At the application level, it works fine. When I enable MFA, I got the code, and when I disable it, I don't get the code. My problem is MFA Status doesn't change in the UI of Cognito Amazon Console, as shown in the above picture.

What is the difference between admin-set-user-mfa-preference and set-user-mfa-preference?

set-user-mfa-preference requires token compulsory as shown in the picture below. But in the code, I have used admin-set-user-mfa-preference

Does that make any differences?

Actually, whether you enable/disable SMS MFA status, it doesn't matter. It works according to the status sent from the application level.

But my concern is -> Is this okay that UI's operation not working?

Answer 1

There are a couple of things which can go wrong with this. My guess would be is that you don't have a phone_number, so no MFA can happen. But you may find any of the following:

1. Lambda/Application doesn't have permissions to change MFA
2. User has no phone_number
3. User Pool MFA not set to Opt-In or Required
4. Role Userpool needs for accessing SNS for MFA messages not setup
5. SNS SMS budget hasn't been increased past default of 1 USD
6. Missing phone_number_verified or email_verified (seems you have email)

You will probably be one of 1-3, the others are just other stuff I have found when working with Cognito.