NotAuthorizedServiceException when answering NEW_PASSWORD_REQUIRED challenge

[JorgeAndresDiazz]

NotAuthorizedServiceException when answering NEW_PASSWORD_REQUIRED challenge

[NikaHsn]

@JorgeAndresDiazz thanks for taking the time to raise this issue. we will look into this and get back to you.

[JorgeAndresDiazz]

Thank you @NikaHsn. For additional information, please take into account that the exception occurs even though
new password request (2nd custom challenge "NEW_PASSWORD_REQUIRED") is requested first (before OTP CUSTOM CHALLENGE). I mean, if the following code is the only challenge the login flow has:

// NEW PASSWORD REQUIRED
      final isSetNewPassword = otpChallengeResult.nextStep.signInStep ==
          AuthSignInStep.confirmSignInWithNewPassword;
      if (isSetNewPassword) {
        const newPassword = 'abc1234'; // This is gotten from the user

        final newPasswordResult = await Amplify.Auth.confirmSignIn(
          confirmationValue: newPassword,
        );

I still get the same exception (NotAuthorizedServiceException "message": "Invalid session provided for the user.") when calling await Amplify.Auth.confirmSignIn.

I could replicate the same issue after using Amplify Authenticator package as well (https://ui.docs.amplify.aws/flutter/connected-components/authenticator ). I evaluated AuthenticatorStep.confirmSignInNewPassword and called state.confirmSignInNewPassword() method, which threw the exception

[NikaHsn]

@JorgeAndresDiazz thank you for providing these details. we will look into this issue and get back to you with any updates.

[JorgeAndresDiazz]

Hi @NikaHsn. Do we have any news regarding this issue?

[Jordan-Nelson]

Hi @JorgeAndresDiazz - I believe in response to AuthSignInStep.confirmSignInWithNewPassword you should invoke Amplify.Auth.confirmResetPassword() with the confirmation code that was sent to the user along with the new password and username.

I think this is a mistake in the documentation. Can you try Amplify.Auth.confirmResetPassword() and let me know if you face any issues?

[JorgeAndresDiazz]

Hey @Jordan-Nelson, thank you for replying

It's not possible to use Amplify.Auth.confirmResetPassword(...) since it expects a required String confirmationCode, which it's a value we don't have. Please take into account that for the OTP custom challenge (previous challenge from AuthSignInStep.confirmSignInWithNewPassword) we use a custom OTP generator in our lambda trigger, which I think does not relate to the confirmationCode expected by the Amplitude SDK

[Jordan-Nelson]

@JorgeAndresDiazz Thanks for the additional info. In the SRP sign in flow Cognito will send a confirmation code which the end user can input for use in confirmResetPassword(). This may not be the case with custom auth. I have reached out to Cognito to see what the expected response should be when using custom auth. I will let you know what I find.