Error trying to set up user MFA Preferences

Question

I'm using the AWS CLI to enable a MFA user pool with only TOTP MFA (no SMS).

aws cognito-idp set-user-pool-mfa-config --user-pool-id xxxx_xxxx --mfa-configuration OPTIONAL --software-token-mfa-configuration Enabled=true

{
    "SoftwareTokenMfaConfiguration": {
        "Enabled": true
    },
    "MfaConfiguration": "OPTIONAL"
}

Seems okay, right? But when I try to set up an user preference I keep getting this error:

An error occurred (InvalidParameterException) when calling the AdminSetUserMFAPreference operation: User has not set up software token mfa

Command: aws cognito-idp admin-set-user-mfa-preference --user-pool-id xxxx_xxxx --username [email protected] --software-token-mfa-settings Enabled=true

Tryin to use admin-set-user-preference also doesn't work: aws cognito-idp admin-set-user-settings --user-pool-id us-xxxx-xxxx--username [email protected] --mfa-option DeliveryMedium=EMAIL

An error occurred (InvalidParameterException) when calling the AdminSetUserSettings operation: Only phone_number attribute is currently supported as a MFA option.

What am I missing? Does it need an extra configuration not mentioned anywhere in documentation?

Solution:

First you need to get the ACCESS_TOKEN for the user and proceed to start the TOTP process:

aws cognito-idp associate-software-token --access-token ACCESS_TOKEN

(this will generate a unique code that you could use in Google Authenticator)

With the TOTP code retrieved from the Authenticator app run:

aws cognito-idp verify-software-token --access-token ACCESS_TOKEN --user-code USER_CODE

With the successfull message from the previous command you can change the user preference:

aws cognito-idp admin-set-user-mfa-preference --user-pool-id xxxxx --username xxxxxxx --software-token-mfa-settings Enabled=True,PreferredMfa=True

Hi @NitsanAvni I've updated the original question with the solution — Luciano Jr
– Luciano Jr, Commented Aug 21, 2020 at 13:17
I'm just trying to disable the MFA for a specific user, why do i need to set up the TOTP? — AnKing
– AnKing, Commented Jan 11, 2022 at 18:33
@LucianoJr can you create an answer and past your solution in there and accept your answer to mark this question answered — Mickael B.
– Mickael B., Commented May 31, 2022 at 19:09

Luciano Jr · Accepted Answer · 2022-06-01 21:36:32Z

4

Solution:

First you need to get the ACCESS_TOKEN for the user and proceed to start the TOTP process:

aws cognito-idp associate-software-token --access-token ACCESS_TOKEN

(this will generate a unique code that you could use in Google Authenticator)

With the TOTP code retrieved from the Authenticator app run:

aws cognito-idp verify-software-token --access-token ACCESS_TOKEN --user-code USER_CODE

With the successfull message from the previous command you can change the user preference:

aws cognito-idp admin-set-user-mfa-preference --user-pool-id xxxxx --username xxxxxxx --software-token-mfa-settings Enabled=True,PreferredMfa=True

answered Jun 1, 2022 at 21:36

Luciano Jr

1601 silver badge10 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Hadi Mir · Accepted Answer · 2022-10-29 09:28:45Z

0

To setup the TOTP for user you have to call the AWS Cognito APIs in the following order

The associate software token will give you an SecretCode which you will convert to a QR either so that user can scan it with an authenticator app. Then you will call the verify software token and pass it the code generated by the authenticator app. And finally you will enable the MFA by calling the set user preference API. And voila.

answered Oct 29, 2022 at 9:28

Hadi Mir

5,1752 gold badges33 silver badges34 bronze badges

Collectives™ on Stack Overflow

Error trying to set up user MFA Preferences

Solution:

2 Answers 2

Solution:

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

Solution:

2 Answers 2

Solution:

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related