AWS Cognito - Admin Reset User Password WITHOUT Sending Email

user_6855033 0
Viewed 1265

I need to reset some users' passwords but not send forgot password emails. Just reset the password so that the next time they log in I can display a message that they need to request a password reset. Drilling down the most basic thing I need: without informing the user, I need to get them into a RESET_REQUIRED status so that getting the user on the frontend returns a PasswordResetRequiredException.

I originally thought AdminSetUserPassword would work for this, but it puts the user in a state where they need to change their password via some UI that I don't have set up. I'm not sure if there is an extra step I can take there -- set the password with AdminSetUserPassword and then maybe take some other steps?

Otherwise, I've tried a bunch of different things around AdminResetUserPassword.

  • Tried removing any custom message from the Lambda I have that runs on the CustomMessage_ForgotPassword trigger, but that just causes a generic message with code to send.
  • Tried changing the email_verified attribute for the user to false (because the AWS docs state that it will send a password reset email IF they have a verified email), but that makes the password reset itself raise an error.
  • Tried changing the user's email to a temporary (fake) one so the email would get sent there, but the user receives an email when their email is changed.

Does anyone have any experience with this, or is this an impossible request?

amazon-cognito amazon-web-services
1 Answers

I was dealing with this today and thought I'd let you know what I ended up doing.

There are two ways, and two ways only, to get a user into RESET_REQUIRED status:

  1. Use AdminResetUserPassword
  2. Import the user using a Cognito import job (as can be seen in this flow chart)

As you've identified, option 1 will send a code by email or SMS, and no, you cannot easily prevent it from doing so. I opened a support case with AWS Support to ask about this and they couldn't come up with anything either. Eventually, I thought about using the Custom Sender Triggers so that I could decide in that trigger whether or not to send an email/SMS, but it was such a hassle with setting up an external email/SMS sender that I decided not to bother with it.

In our case, we were migrating users from one user pool to another so the import method ended up working fairly well. If you want to just reset a user password in an existing user pool, you could also use the import method:

  1. Read the user attributes, MFA options, etc. using AdminGetUser
  2. Store this data somewhere safe
  3. Delete the user from the Cognito pool using AdminDeleteUser
  4. Import the user by creating and running a Cognito import job

This will succeed in getting your user to RESET_REQUIRED state, but the downsides are:

  • User's sub will change
  • User's remembered devices will be gone
  • User's login history will be gone
  • User's MFA software devices will be gone

So it's a pretty shitty solution, but it's what Cognito has given us to work with.

user_6125800
Related