feat(auth): TOTP MFA #3146

dnys1 · 2023-06-05T18:16:52Z

Implements TOTP MFA as part of the signIn flow.
Adds category methods for setting up TOTP outside the signIn flow.
Adds plugin methods for getting/setting the user's MFA preferences at any time.

Kaspear · 2023-06-19T10:05:18Z

@dnys1 Thanks for taking care of this! When do you think this feature will be released?

dnys1 · 2023-06-21T17:02:25Z

@Kaspear I don't have any firm timeframe yet, but it is one of our highest priority issues!

Equartey

Totally crushed this one. I've been using this branch for the past couple weeks and it's worked great 🎉

Still needing to test the multiple MFA selection workflow, but here's some feedback in the meantime 😁

packages/amplify_core/lib/src/types/auth/auth_types.dart

packages/auth/amplify_auth_cognito_dart/example/bin/example.dart

packages/test/amplify_auth_integration_test/lib/src/mfa_environments.dart

packages/auth/amplify_auth_cognito_dart/lib/src/state/machines/sign_in_state_machine.dart

packages/auth/amplify_auth_cognito_dart/lib/src/state/machines/totp_setup_state_machine.dart

Equartey · 2023-06-27T18:53:49Z

packages/auth/amplify_auth_cognito/example/integration_test/mfa_sms_totp_test.dart

Love all these test 🎉

Can we make this test file more digestible and easier to maintain? Maybe consider adding contextual comments to each scenario or breaking it up into two at least two files based on the testRunners. Either case I think would help provide better maintainer DX imo

I've split the tests into multiple files. I've tried to leave rationale for many of the expectations. Given they all follow the same pattern (lots of copy/paste between the tests), I think grokking one test makes the rest simple to understand.

mikolaj1982 · 2023-07-03T01:00:18Z

that looks great! I also sit for last couple of week on branch feat/auth/totp and seem like totp with authenticator app is all working so can't wait for release. Thank you for your hard work @dnys1

Jordan-Nelson · 2023-07-07T16:37:52Z

packages/amplify_core/lib/src/types/auth/mfa/user_mfa_preference.dart

+  const UserMfaPreference({
+    Set<MfaType>? enabled,
+    this.preferred,
+  }) : enabled = enabled ?? const {};


Maybe I am missing something. Why not:

const UserMfaPreference({ this.enabled = const {}, this.preferred, });

I was wanting passing null before because it makes things like list?.map(...).toSet() cleaner if I don't have to duplicate ?? const {} everywhere. But I changed it since I'm not doing that any more.

Jordan-Nelson · 2023-07-07T16:42:49Z

packages/amplify_core/lib/src/types/auth/mfa/user_mfa_preference.dart

+
+  @override
+  Map<String, Object?> toJson() => {
+        'enabled': enabled.map((typ) => typ.name.toUpperCase()).toList(),


Is this supposed to be type?

Either way. Updated to type.

Jordan-Nelson · 2023-07-07T19:39:12Z

packages/amplify_core/lib/src/category/amplify_auth_category.dart

+  /// Initiates setup of a time-based one-time passcode (TOTP) MFA method for the
+  /// current user.
+  ///
+  /// Your backend must be set up with TOTP MFA enabled prior to calling this method.


What exception is thrown if the back end isn't set up for totp mfa?

SoftwareTokenMFANotFoundException

Jordan-Nelson · 2023-07-07T19:42:24Z

packages/amplify_core/lib/src/types/auth/mfa/totp_setup_details.dart

+    String? accountName,
+  }) =>
+      Uri(
+        scheme: 'otpauth',


This scheme is used by all authenticator apps (or, at least all popular ones - MS, Google, Authy, Last Pass, etc.)?

Yes, while there isn't a formal specification for otp URIs, this is the commonly used schema. The popular apps recognize this schema, this is made clear by their apps opening via native platform API calls with this schema. Which is exactly what we are doing in our Authenticator TOTP work.

Equartey

Discussed offline. Here is my fix for the infra script failures

infra/lib/auth/stack.create-user.ts

luigi198 · 2023-07-27T22:05:29Z

Hi, we are deciding if we are going to use Amplify - Flutter and MFA with TOTP is a requirement, do you guys have an ETA for this feature to be deployed? if not I think we will not be able to use Amplify for our project. thanks!
@dnys1

abdallahshaban557 · 2023-07-28T14:51:41Z

Hi @luigi198 - we are getting really close to shipping this, we are doing our internal rounds of reviews. When would you like this to be available by?

luigi198 · 2023-07-28T15:39:39Z

@abdallahshaban557 We are working on a PoC to prove we can use this tech, we will be implementing MFA probably in September, we noticed you guys deployed a new version today, that's a good sign for my boss, if I can get a written confirmation MFA TOTP will be supported for September (we are flexible with the month, we can work on other features meanwhile), we are probably good to go

abdallahshaban557 · 2023-07-28T17:32:39Z

Hi @luigi198 - we should have it ready by then. Thank you for letting us know!

Expands E2E backends for all TOTP/SMS MFA combinations.

Fix casing when mapping SDK exceptions.

Adds TOTP MFA support to the `signIn` and `confirmSignIn` flows and adds two new methods to the Cognito plugin for fetching and updating the user's MFA preferences: `fetchMfaPreference` and `updateMfaPreference`.

Adds E2E tests for TOTP MFA and splits existing MFA tests by backend configuration: SMS, TOTP, and SMS/TOTP.

Equartey · 2023-08-21T15:17:00Z

packages/amplify_core/doc/lib/auth.dart

@@ -199,6 +215,23 @@ Future<void> confirmMfaUser(String mfaCode) async {
 }
 // #enddocregion confirm-signin

+// #docregion handle-mfa-selection
+Future<MfaType> _promptUserPreference(Set<MfaType> allowedTypes) async {
+  throw UnimplementedError();


Should this be implemented?

Updated in favor of // ...

Equartey · 2023-08-21T15:22:51Z

packages/auth/amplify_auth_cognito/example/ios/Runner.xcodeproj/project.pbxproj

@@ -155,7 +155,7 @@
 		97C146E61CF9000F007C117D /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 1300;
+				LastUpgradeCheck = 1430;


Been seeing this change locally. Does this typically get committed? If so, what's the significance?

Yeah, it should be committed. Flutter and Xcode updates can modify the project settings.

Equartey · 2023-08-21T15:33:44Z

packages/amplify_core/lib/src/category/amplify_auth_category.dart

+  /// The [TotpSetupDetails] returned contains a [TotpSetupDetails.getSetupUri]
+  /// method which can be used to display a QR code or render a button to open
+  /// the user's installed authenticator app. After setup is complete on the user's
+  /// end, call [verifyTotpSetup] with a one-time code to complete registration.


I might reword this section to make it clear TotpSetupDetails.getSetupUri return's the URI. Right now it reads like it shows the relevant QR code.

Suggested change

/// The [TotpSetupDetails] returned contains a [TotpSetupDetails.getSetupUri]

/// method which can be used to display a QR code or render a button to open

/// the user's installed authenticator app. After setup is complete on the user's

/// end, call [verifyTotpSetup] with a one-time code to complete registration.

/// The [TotpSetupDetails] returned contains a [TotpSetupDetails.getSetupUri]

/// method for retrieving the setup URI. Which can be used to build a QR code or

/// a button to open the user's installed authenticator app. After setup is complete

/// on the user's end, call [verifyTotpSetup] with a one-time code to complete registration.

abdallahshaban557 · 2023-08-30T03:23:22Z

@Kaspear @mikolaj1982 @luigi198 - Just wanted to make sure you are aware that this feature has now been launched! It is available from the Amplify Flutter library and the Authenticator UI component.

billnice250 · 2023-08-30T06:36:53Z

@dnys1
Thanks a lot for your effort!
Already integrated it in my app yesterday and everything is working smoothly!

This was referenced Jun 5, 2023

feat(auth): TOTP MFA #1770

Closed

Auth - how do I check if MFA is enabled? #2908

Closed

dnys1 force-pushed the feat/auth/totp branch 5 times, most recently from 8d6f87b to 282b1c0 Compare June 14, 2023 20:43

dnys1 force-pushed the feat/auth/totp branch from 282b1c0 to 96879ed Compare June 21, 2023 13:42

dnys1 force-pushed the feat/auth/totp branch from 96879ed to 67f78f9 Compare June 23, 2023 19:05

dnys1 marked this pull request as ready for review June 23, 2023 19:05

dnys1 requested a review from a team as a code owner June 23, 2023 19:05

dnys1 force-pushed the feat/auth/totp branch 2 times, most recently from 80ba8b4 to 76c343b Compare June 23, 2023 19:27

Equartey reviewed Jun 27, 2023

View reviewed changes

fjnoyp mentioned this pull request Jul 7, 2023

Access / ID Tokens not getting refreshed #3355

Closed

14 tasks

dnys1 force-pushed the feat/auth/totp branch 2 times, most recently from c19fd2e to d06e6b0 Compare July 7, 2023 19:43

Jordan-Nelson previously approved these changes Jul 7, 2023

View reviewed changes

Equartey previously approved these changes Jul 10, 2023

View reviewed changes

dnys1 dismissed stale reviews from Equartey and Jordan-Nelson via 403c387 July 10, 2023 18:49

Equartey requested changes Jul 11, 2023

View reviewed changes

infra/lib/auth/stack.create-user.ts Outdated Show resolved Hide resolved

infra/lib/auth/stack.create-user.ts Outdated Show resolved Hide resolved

dnys1 force-pushed the feat/auth/totp branch from 27f6a73 to a340cd8 Compare July 17, 2023 16:08

dnys1 mentioned this pull request Jul 19, 2023

Update MFA settings for specific user in Cognito #770

Closed

dnys1 added the pr:squash PR should be submitted with a sqaush commit label Jul 20, 2023

dnys1 requested a review from Equartey July 20, 2023 17:56

dnys1 force-pushed the feat/auth/totp branch from 20faded to eee8a74 Compare July 21, 2023 20:33

dnys1 force-pushed the feat/auth/totp branch from eee8a74 to fde2534 Compare August 1, 2023 16:42

dnys1 force-pushed the feat/auth/totp branch 2 times, most recently from 72f11e9 to 263ae08 Compare August 17, 2023 21:49

Dillon Nys added 6 commits August 21, 2023 08:12

feat(infra): MFA backends

2f4249a

Expands E2E backends for all TOTP/SMS MFA combinations.

fix(auth): SDK exception mapping

dd4be3f

Fix casing when mapping SDK exceptions.

chore(auth): Add SetUserMFAPreference SDK method

5082687

feat(auth): TOTP MFA

a5ae05d

Adds TOTP MFA support to the `signIn` and `confirmSignIn` flows and adds two new methods to the Cognito plugin for fetching and updating the user's MFA preferences: `fetchMfaPreference` and `updateMfaPreference`.

test(auth): TOTP MFA tests

7eb6fbf

Adds E2E tests for TOTP MFA and splits existing MFA tests by backend configuration: SMS, TOTP, and SMS/TOTP.

ci(auth): Bump e2e test timeout to 90 minutes

804ba2c

dnys1 force-pushed the feat/auth/totp branch from 263ae08 to 17f212c Compare August 21, 2023 15:26

Equartey reviewed Aug 21, 2023

View reviewed changes

docs(auth): Update TOTP snippets

16df8cf

dnys1 force-pushed the feat/auth/totp branch from 17f212c to 16df8cf Compare August 21, 2023 15:52

Equartey approved these changes Aug 21, 2023

View reviewed changes

Jordan-Nelson approved these changes Aug 24, 2023

View reviewed changes

dnys1 merged commit 4d50bb1 into main Aug 24, 2023
192 of 207 checks passed

dnys1 deleted the feat/auth/totp branch August 24, 2023 19:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): TOTP MFA #3146

feat(auth): TOTP MFA #3146

dnys1 commented Jun 5, 2023 •

edited

Loading

Kaspear commented Jun 19, 2023

dnys1 commented Jun 21, 2023

Equartey left a comment

Equartey Jun 27, 2023

dnys1 Jul 10, 2023

mikolaj1982 commented Jul 3, 2023

Jordan-Nelson Jul 7, 2023

dnys1 Jul 10, 2023

Jordan-Nelson Jul 7, 2023

dnys1 Jul 10, 2023

Jordan-Nelson Jul 7, 2023

dnys1 Jul 10, 2023

Jordan-Nelson Jul 7, 2023

Equartey Jul 10, 2023

Equartey left a comment

luigi198 commented Jul 27, 2023 •

edited

Loading

abdallahshaban557 commented Jul 28, 2023

luigi198 commented Jul 28, 2023

abdallahshaban557 commented Jul 28, 2023

Equartey Aug 21, 2023

dnys1 Aug 21, 2023

Equartey Aug 21, 2023

dnys1 Aug 21, 2023

Equartey Aug 21, 2023

dnys1 Aug 21, 2023

abdallahshaban557 commented Aug 30, 2023

billnice250 commented Aug 30, 2023

feat(auth): TOTP MFA #3146

feat(auth): TOTP MFA #3146

Conversation

dnys1 commented Jun 5, 2023 • edited Loading

Kaspear commented Jun 19, 2023

dnys1 commented Jun 21, 2023

Equartey left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikolaj1982 commented Jul 3, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Equartey left a comment

Choose a reason for hiding this comment

luigi198 commented Jul 27, 2023 • edited Loading

abdallahshaban557 commented Jul 28, 2023

luigi198 commented Jul 28, 2023

abdallahshaban557 commented Jul 28, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abdallahshaban557 commented Aug 30, 2023

billnice250 commented Aug 30, 2023

dnys1 commented Jun 5, 2023 •

edited

Loading

luigi198 commented Jul 27, 2023 •

edited

Loading