aws / aws/aws-sdk-cpp

cognito-idp: "SECRET_HASH was not received" with USER_SRP_AUTH

未关闭
#3,246 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug needs-reproduction
主要语言
C++
星标
2.2k
派生
1.2k
平均合并
4 天 11 小时
30 天内合并 PR
13

描述

### Describe the bug

Hello!
I'm trying to authenticate a user using `CognitoIdentityProviderClient`.

**TL;DR:** Using USER_SRP_AUTH flow and a correct secret_hash, I get a response saying SECRET_HASH was not sent.

Here's the relevant portion of the code:
```
Aws::Map authParameters;
authParameters["USERNAME"] = username.c_str();
// authParameters["PASSWORD"] = password.c_str(); // Used to test with USER_PASSWORD_AUTH below

authParameters["SECRET_HASH"] = "some_secret_hash";
authParameters["SRP_A"] = srp.A();

Aws::CognitoIdentityProvider::CognitoIdentityProviderClient cipClient(clientConfig );

Aws::CognitoIdentityProvider::Model::InitiateAuthRequest authRequest;
authRequest.SetClientId( m_clientID.c_str() );
// authRequest.SetAuthFlow(Aws::CognitoIdentityProvider::Model::AuthFlowType::USER_PASSWORD_AUTH );
authRequest.SetAuthFlow(Aws::CognitoIdentityProvider::Model::AuthFlowType::USER_SRP_AUTH );

authRequest.SetAuthParameters( authParameters );
Aws::Map __authParameters = authRequest.GetAuthParameters();
// check if the correct value is in the map. It is.

Aws::CognitoIdentityProvider::Model::InitiateAuthOutcome authResult = cipClient.InitiateAuth( authRequest );
```

Then I get: "NotAuthorizedException: Client is configured with secret but SECRET_HASH was not received"

- I have tested all the credentials (user, password, pool Id, app ID, secret_hash, SRP_A, same flow type, etc...) with both Python's `boto3` and `requests` and it works fine both ways (i get tokens and challange).

- Strangely, in the c++ version above:
- Using USER_PASSWORD_AUTH flow instead (and provide a password in the `authParameters`), I don't get the error of "SECRET_HASH was not received"
- Using USER_SRP_AUTH and `authParameters["SECRET_HASH"] = "some_INCORRECT_secret_hash"`, I get an error saying the hash was not correct (but it was, apparently, received)

From what I have read in several StackOverflow that SRP doesn't work with apps with secrets, but those threads seem outdated, and the python test seems to disprove that?

Could you please advise? Is this a limitation of the c++ sdk or is this a bug?

Many thanks in advance!

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Expected Behavior

Expect to receive either a success response or an invalid credentials error, but not a "not sent" error.

### Current Behavior

See description of the bug

### Reproduction Steps

See description of the bug

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CPP SDK version used

1.11.483

### Compiler and Version used

clang-1600.0.26.6

### Operating System and version

macOS 15.2

贡献指南

打开贡献指南

调研方向

从 CognitoIdentityProviderClient::InitiateAuth 和 InitiateAuthRequest 的身份验证参数处理入手,使用 SECRET_HASH 重现 USER_SRP_AUTH,并将其与 USER_PASSWORD_AUTH 进行比较。使用 macOS 上的 clang 和 SDK 1.11.483,检查序列化后的请求是否为 SRP 流保留 SECRET_HASH。完成标准是:SRP 请求不再报告 SECRET_HASH 缺失,并且仍能区分无效凭据和省略的 hash。

由索引模型根据 Issue 内容生成。

评估

技术栈
aws, cpp
领域
api, authentication
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
冷清
描述清晰度
需要澄清
新手友好度
45/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。