User migration lambda in AWS Cognito

[rolandtreibersimpleonlinehealthcare]

Hi!
I am trying to make the user migration lambda function work in php with bref.
https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-import-using-lambda.html
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html

The way it is supposed to work:

• The user initiates auth entering their credentials
• Cognito auth flow fails as the user is not yet in the Cognito user pool
• At this point the Migrate User lambda is triggered and receives the entered credentials
• It then evaluates whether or not the user exists in the source where users are migrated from (custom logic)
• If succeeded, creates an user in Cognito and continues as a successful login

The issue:

• The function receives the credentials ok and returns the event array in the desired format, however it always fails and does not return any meaningful errors

I have noticed that in the AWS docs nodejs sample code that a succeed method is called on the context with the event as the only argument. I recreated it and it works with nodejs.

I suspect that succeed method returns the object in a different way either hashing it or modifying it some other way. I haven't managed to find an equivalent in bref nor guidance on how to go about it.

Has anyone tried to do what I am working on? Is there a solution for it?

My code:

    public function handle($event, Context $context): array
    {
        $email = Arr::get($event, 'userName');
        $password = Arr::get($event, 'request.password');

        if ($customer = CUSTOM_AUTHENTICATION_THAT_RETURNS_THE_CUSTOMER) {

            Arr::set($event, 'response', [
                "userAttributes" => [
                    "email" => $customer->getEmail(),
                    "email_verified" => true,
                    "phone_number_verified" => false
                ],
                "finalUserStatus" => "CONFIRMED",
                "messageAction" => "SUPPRESS",
                "forceAliasCreation" => true,
                "desiredDeliveryMediums" => ["EMAIL"]
            ]);

            return $event;
        }

        throw new Exception('Legacy user not found.');
    }

Many thanks!

[RTC1]

Any potential solutions for this?

[mnapoli]

Oh wow, I'm really confused the Node example too. It's the first time I see this:

It seems to be an old way of returning a result: https://stackoverflow.com/a/47906248/245552

So your PHP sample looks correct to me. Maybe it might be worth going a second time over the actual documentation for this event: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html maybe it's just a field missing?

[ddeboer]

I ran into the same problem. AWS returned a UserNotFoundException from our migration trigger without any additional details, neither in the response nor in the logs.

This is caused by validationData defaulting to an empty array [], which is then json_encoded as '[]'. Cognito, however, expects a (nullable) object for validationData.

You can solve this by setting validationData to either null or stdClass, which then becomes JSON null or {}. See also #1731.