Skip to content

Commit 54b56e9

Browse files
author
awstools
committed
feat(client-cognito-identity-provider): Amazon Cognito now supports trigger versions that define the fields in the request sent to pre token generation Lambda triggers.
1 parent 5ef61b5 commit 54b56e9

23 files changed

+906
-408
lines changed

‎clients/client-cognito-identity-provider/README.md

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,36 @@
66

77
AWS SDK for JavaScript CognitoIdentityProvider Client for Node.js, Browser and React Native.
88

9-
<p>With the Amazon Cognito user pools API, you can set up user pools and app clients, and
10-
authenticate users. To authenticate users from third-party identity providers (IdPs) in
11-
this API, you can <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
12-
about the authentication and authorization of federated users in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">Using the Amazon Cognito user pools API and user pool endpoints</a>.</p>
9+
<p>With the Amazon Cognito user pools API, you can configure user pools and authenticate users. To
10+
authenticate users from third-party identity providers (IdPs) in this API, you can
11+
<a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
12+
about the authentication and authorization of federated users at <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html">Adding user pool sign-in through a third party</a> and in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">User pool federation endpoints and hosted UI reference</a>.</p>
1313
<p>This API reference provides detailed information about API operations and object types
14-
in Amazon Cognito. At the bottom of the page for each API operation and object, under
15-
<i>See Also</i>, you can learn how to use it in an Amazon Web Services SDK in the
16-
language of your choice.</p>
14+
in Amazon Cognito.</p>
1715
<p>Along with resource management operations, the Amazon Cognito user pools API includes classes
18-
of operations and authorization models for client-side and server-side user operations.
19-
For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito native and OIDC APIs</a> in the
20-
<i>Amazon Cognito Developer Guide</i>.</p>
21-
<p>You can also start reading about the <code>CognitoIdentityProvider</code> client in
22-
the following SDK guides.</p>
16+
of operations and authorization models for client-side and server-side authentication of
17+
users. You can interact with operations in the Amazon Cognito user pools API as any of the
18+
following subjects.</p>
19+
<ol>
20+
<li>
21+
<p>An administrator who wants to configure user pools, app clients, users,
22+
groups, or other user pool functions.</p>
23+
</li>
24+
<li>
25+
<p>A server-side app, like a web application, that wants to use its Amazon Web Services
26+
privileges to manage, authenticate, or authorize a user.</p>
27+
</li>
28+
<li>
29+
<p>A client-side app, like a mobile app, that wants to make unauthenticated
30+
requests to manage, authenticate, or authorize a user.</p>
31+
</li>
32+
</ol>
33+
<p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito user pools API and user pool endpoints</a>
34+
in the <i>Amazon Cognito Developer Guide</i>.</p>
35+
<p>With your Amazon Web Services SDK, you can build the logic to support operational flows in every use
36+
case for this API. You can also make direct REST API requests to <a href="https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html#cognito_identity_your_user_pools_region">Amazon Cognito user pools service endpoints</a>. The following links can get you started
37+
with the <code>CognitoIdentityProvider</code> client in other supported Amazon Web Services
38+
SDKs.</p>
2339
<ul>
2440
<li>
2541
<p>

‎clients/client-cognito-identity-provider/src/CognitoIdentityProvider.ts

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2166,20 +2166,36 @@ export interface CognitoIdentityProvider {
21662166

21672167
/**
21682168
* @public
2169-
* <p>With the Amazon Cognito user pools API, you can set up user pools and app clients, and
2170-
* authenticate users. To authenticate users from third-party identity providers (IdPs) in
2171-
* this API, you can <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
2172-
* about the authentication and authorization of federated users in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">Using the Amazon Cognito user pools API and user pool endpoints</a>.</p>
2169+
* <p>With the Amazon Cognito user pools API, you can configure user pools and authenticate users. To
2170+
* authenticate users from third-party identity providers (IdPs) in this API, you can
2171+
* <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
2172+
* about the authentication and authorization of federated users at <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html">Adding user pool sign-in through a third party</a> and in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">User pool federation endpoints and hosted UI reference</a>.</p>
21732173
* <p>This API reference provides detailed information about API operations and object types
2174-
* in Amazon Cognito. At the bottom of the page for each API operation and object, under
2175-
* <i>See Also</i>, you can learn how to use it in an Amazon Web Services SDK in the
2176-
* language of your choice.</p>
2174+
* in Amazon Cognito.</p>
21772175
* <p>Along with resource management operations, the Amazon Cognito user pools API includes classes
2178-
* of operations and authorization models for client-side and server-side user operations.
2179-
* For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito native and OIDC APIs</a> in the
2180-
* <i>Amazon Cognito Developer Guide</i>.</p>
2181-
* <p>You can also start reading about the <code>CognitoIdentityProvider</code> client in
2182-
* the following SDK guides.</p>
2176+
* of operations and authorization models for client-side and server-side authentication of
2177+
* users. You can interact with operations in the Amazon Cognito user pools API as any of the
2178+
* following subjects.</p>
2179+
* <ol>
2180+
* <li>
2181+
* <p>An administrator who wants to configure user pools, app clients, users,
2182+
* groups, or other user pool functions.</p>
2183+
* </li>
2184+
* <li>
2185+
* <p>A server-side app, like a web application, that wants to use its Amazon Web Services
2186+
* privileges to manage, authenticate, or authorize a user.</p>
2187+
* </li>
2188+
* <li>
2189+
* <p>A client-side app, like a mobile app, that wants to make unauthenticated
2190+
* requests to manage, authenticate, or authorize a user.</p>
2191+
* </li>
2192+
* </ol>
2193+
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito user pools API and user pool endpoints</a>
2194+
* in the <i>Amazon Cognito Developer Guide</i>.</p>
2195+
* <p>With your Amazon Web Services SDK, you can build the logic to support operational flows in every use
2196+
* case for this API. You can also make direct REST API requests to <a href="https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html#cognito_identity_your_user_pools_region">Amazon Cognito user pools service endpoints</a>. The following links can get you started
2197+
* with the <code>CognitoIdentityProvider</code> client in other supported Amazon Web Services
2198+
* SDKs.</p>
21832199
* <ul>
21842200
* <li>
21852201
* <p>

‎clients/client-cognito-identity-provider/src/CognitoIdentityProviderClient.ts

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -719,20 +719,36 @@ export interface CognitoIdentityProviderClientResolvedConfig extends CognitoIden
719719

720720
/**
721721
* @public
722-
* <p>With the Amazon Cognito user pools API, you can set up user pools and app clients, and
723-
* authenticate users. To authenticate users from third-party identity providers (IdPs) in
724-
* this API, you can <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
725-
* about the authentication and authorization of federated users in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">Using the Amazon Cognito user pools API and user pool endpoints</a>.</p>
722+
* <p>With the Amazon Cognito user pools API, you can configure user pools and authenticate users. To
723+
* authenticate users from third-party identity providers (IdPs) in this API, you can
724+
* <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html">link IdP users to native user profiles</a>. Learn more
725+
* about the authentication and authorization of federated users at <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html">Adding user pool sign-in through a third party</a> and in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-userpools-server-contract-reference.html">User pool federation endpoints and hosted UI reference</a>.</p>
726726
* <p>This API reference provides detailed information about API operations and object types
727-
* in Amazon Cognito. At the bottom of the page for each API operation and object, under
728-
* <i>See Also</i>, you can learn how to use it in an Amazon Web Services SDK in the
729-
* language of your choice.</p>
727+
* in Amazon Cognito.</p>
730728
* <p>Along with resource management operations, the Amazon Cognito user pools API includes classes
731-
* of operations and authorization models for client-side and server-side user operations.
732-
* For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito native and OIDC APIs</a> in the
733-
* <i>Amazon Cognito Developer Guide</i>.</p>
734-
* <p>You can also start reading about the <code>CognitoIdentityProvider</code> client in
735-
* the following SDK guides.</p>
729+
* of operations and authorization models for client-side and server-side authentication of
730+
* users. You can interact with operations in the Amazon Cognito user pools API as any of the
731+
* following subjects.</p>
732+
* <ol>
733+
* <li>
734+
* <p>An administrator who wants to configure user pools, app clients, users,
735+
* groups, or other user pool functions.</p>
736+
* </li>
737+
* <li>
738+
* <p>A server-side app, like a web application, that wants to use its Amazon Web Services
739+
* privileges to manage, authenticate, or authorize a user.</p>
740+
* </li>
741+
* <li>
742+
* <p>A client-side app, like a mobile app, that wants to make unauthenticated
743+
* requests to manage, authenticate, or authorize a user.</p>
744+
* </li>
745+
* </ol>
746+
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito user pools API and user pool endpoints</a>
747+
* in the <i>Amazon Cognito Developer Guide</i>.</p>
748+
* <p>With your Amazon Web Services SDK, you can build the logic to support operational flows in every use
749+
* case for this API. You can also make direct REST API requests to <a href="https://docs.aws.amazon.com/general/latest/gr/cognito_identity.html#cognito_identity_your_user_pools_region">Amazon Cognito user pools service endpoints</a>. The following links can get you started
750+
* with the <code>CognitoIdentityProvider</code> client in other supported Amazon Web Services
751+
* SDKs.</p>
736752
* <ul>
737753
* <li>
738754
* <p>

‎clients/client-cognito-identity-provider/src/commands/AdminAddUserToGroupCommand.ts

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,9 @@ export interface AdminAddUserToGroupCommandOutput extends __MetadataBearer {}
4242

4343
/**
4444
* @public
45-
* <p>Adds the specified user to the specified group.</p>
45+
* <p>Adds a user to a group. A user who is in a group can present a preferred-role claim to
46+
* an identity pool, and populates a <code>cognito:groups</code> claim to their access and
47+
* identity tokens.</p>
4648
* <note>
4749
* <p>Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For
4850
* this operation, you must use IAM credentials to authorize requests, and you must

‎clients/client-cognito-identity-provider/src/commands/AdminConfirmSignUpCommand.ts

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,15 @@ export interface AdminConfirmSignUpCommandOutput extends AdminConfirmSignUpRespo
4646

4747
/**
4848
* @public
49-
* <p>Confirms user registration as an admin without using a confirmation code. Works on any
50-
* user.</p>
49+
* <p>This IAM-authenticated API operation provides a code that Amazon Cognito sent to your user
50+
* when they signed up in your user pool. After your user enters their code, they confirm
51+
* ownership of the email address or phone number that they provided, and their user
52+
* account becomes active. Depending on your user pool configuration, your users will
53+
* receive their confirmation code in an email or SMS message.</p>
54+
* <p>Local users who signed up in your user pool are the only type of user who can confirm
55+
* sign-up with a code. Users who federate through an external identity provider (IdP) have
56+
* already been confirmed by their IdP. Administrator-created users confirm their accounts
57+
* when they respond to their invitation email message and choose a password.</p>
5158
* <note>
5259
* <p>Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For
5360
* this operation, you must use IAM credentials to authorize requests, and you must

‎clients/client-cognito-identity-provider/src/commands/AdminListGroupsForUserCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ export interface AdminListGroupsForUserCommandOutput extends AdminListGroupsForU
4646

4747
/**
4848
* @public
49-
* <p>Lists the groups that the user belongs to.</p>
49+
* <p>Lists the groups that a user belongs to.</p>
5050
* <note>
5151
* <p>Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For
5252
* this operation, you must use IAM credentials to authorize requests, and you must

‎clients/client-cognito-identity-provider/src/commands/AdminRespondToAuthChallengeCommand.ts

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,13 @@ export interface AdminRespondToAuthChallengeCommandOutput
4949

5050
/**
5151
* @public
52-
* <p>Responds to an authentication challenge, as an administrator.</p>
52+
* <p>Some API operations in a user pool generate a challenge, like a prompt for an MFA
53+
* code, for device authentication that bypasses MFA, or for a custom authentication
54+
* challenge. An <code>AdminRespondToAuthChallenge</code> API request provides the answer
55+
* to that challenge, like a code or a secure remote password (SRP). The parameters of a
56+
* response to an authentication challenge vary with the type of challenge.</p>
57+
* <p>For more information about custom authentication challenges, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html">Custom
58+
* authentication challenge Lambda triggers</a>.</p>
5359
* <note>
5460
* <p>This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers
5561
* require you to register an origination phone number before you can send SMS messages

‎clients/client-cognito-identity-provider/src/commands/AdminUserGlobalSignOutCommand.ts

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,30 @@ export interface AdminUserGlobalSignOutCommandOutput extends AdminUserGlobalSign
4646

4747
/**
4848
* @public
49-
* <p>Signs out a user from all devices. <code>AdminUserGlobalSignOut</code> invalidates all
50-
* identity, access and refresh tokens that Amazon Cognito has issued to a user. A user can still
51-
* use a hosted UI cookie to retrieve new tokens for the duration of the 1-hour cookie
52-
* validity period.</p>
53-
* <p>Your app isn't aware that a user's access token is revoked unless it attempts to
54-
* authorize a user pools API request with an access token that contains the scope
55-
* <code>aws.cognito.signin.user.admin</code>. Your app might otherwise accept access
56-
* tokens until they expire.</p>
49+
* <p>Invalidates the identity, access, and refresh tokens that Amazon Cognito issued to a user. Call
50+
* this operation with your administrative credentials when your user signs out of your
51+
* app. This results in the following behavior. </p>
52+
* <ul>
53+
* <li>
54+
* <p>Amazon Cognito no longer accepts <i>token-authorized</i> user operations
55+
* that you authorize with a signed-out user's access tokens. For more information,
56+
* see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html">Using the Amazon Cognito user pools API and user pool
57+
* endpoints</a>.</p>
58+
* <p>Amazon Cognito returns an <code>Access Token has been revoked</code> error when your
59+
* app attempts to authorize a user pools API request with a revoked access token
60+
* that contains the scope <code>aws.cognito.signin.user.admin</code>.</p>
61+
* </li>
62+
* <li>
63+
* <p>Amazon Cognito no longer accepts a signed-out user's ID token in a <a href="https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetId.html">GetId </a> request to an identity pool with
64+
* <code>ServerSideTokenCheck</code> enabled for its user pool IdP
65+
* configuration in <a href="https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_CognitoIdentityProvider.html">CognitoIdentityProvider</a>.</p>
66+
* </li>
67+
* <li>
68+
* <p>Amazon Cognito no longer accepts a signed-out user's refresh tokens in refresh
69+
* requests.</p>
70+
* </li>
71+
* </ul>
72+
* <p>Other requests might be valid until your user's token expires.</p>
5773
* <note>
5874
* <p>Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For
5975
* this operation, you must use IAM credentials to authorize requests, and you must

0 commit comments

Comments
 (0)