pmill / aws-cognito

A PHP library for AWS Cognito user pools

pmill/aws-cognito

Introduction

This library contains a PHP client for AWS Cognito user pools.

Requirements

This library package requires PHP 7.1 or later

Installation

Installing via Composer

The recommended way to install is through Composer.

# Install Composer
curl -sS https://getcomposer.org/installer | php

Next, run the Composer command to install the latest version:

php composer.phar require pmill/aws-cognito

Usage

There are example usage scripts in the examples/ folder, copy examples/config.example.php to examples/config.php before running them.

Version History

0.2.11 (06/01/2020)

Added method to get a user by an access token - bjoernHeneka

0.2.10 (21/10/2019)

• Added tests - franjid

0.2.9 (17/10/2019)

• Added method to all administrators to delete a user - bjoernHeneka

0.2.8 (28/01/2019)

• Added method to get user groups - abelland

0.2.7 (17/08/2018)

• Added method to get user details - brettmc

0.2.6 (27/06/2018)

• Added method to update a user's custom variables - bjoernHeneka

0.2.5 (26/06/2018)

• Added method to add a user to a group - bjoernHeneka

0.2.4 (22/04/2018)

• Bugfix - Cognito::signUp requires string attributes

0.2.3 (27/01/2018)

• Mapped additional error responses to exceptions

0.2.2 (27/01/2018)

• Added handling for password reset required responses

0.2.1 (25/01/2018)

• Added method to return full token payload

0.2.0 (25/01/2018)

• Replaced spomky-labs/jose library with web-token/jwt-signature
• Added handling for authentication challenges
• Removed jwt key set caching code, replaced with getter/setter

0.1.3 (12/11/2017)

• Returned generated cognito username when registering

0.1.2 (20/05/2017)

• Added method to refresh authentication tokens

0.1.1 (30/04/2017)

• Returned username when verifying access tokens

0.1.0 (28/04/2017)

• First public release of aws-cognito

Copyright

pmill/aws-cognito Copyright (c) 2017 pmill ([email protected]) All rights reserved.

aws-cognito's Issues

Composer Deprecation Notice

Every time that I run the composer, I'm getting this message:

Deprecation Notice: Class pmill\AwsCognito\Tests\Unit\CognitoClientTest located in ./vendor/pmill/aws-cognito/tests/unit/CognitoClientTest.php does not comply with psr-4 autoloading standard. It will not autoload anymore in Composer v2.0. in phar:///usr/local/bin/composer/src/Composer/Autoload/ClassMapGenerator.php:201

Retrieve custom Attributes

I'm trying to retrieve custom attributes. How can i do that?

What to do after access_token expire and there is no refresh token?

I was using builtin login page. When using response_type=token i don't get refresh token.
When using response_type=code I don't see a way to utilize this class.

So with first approach, after some time, following exception is trigerred (marked with "HERE"):

           try
            {
                $this->client->verifyAccessToken($access_token);
            }
            catch(\pmill\AwsCognito\Exception\TokenExpiryException $e)
            {
// HERE
            }

What would be the best approach to handle this case?

Thank you for this class :)

Uncaught Exception

The AWS SDK, in addition to CognitoIdentityProviderException seems to also throw GuzzleHttp\Exception\ClientException.

public function registerUser() for example throws this for {"__type":"UsernameExistsException","message":"User already exists"}
(See error snippet below).

This doesn't get caught and mapped to the pmill\AwsCognito\Exception's.
Making the error handling significantly harder for the caller method.

(Related #20?)

Fatal error: Uncaught GuzzleHttp\Exception\ClientException: Client error: `POST https://cognito-idp.us-east-1.amazonaws.com` resulted in a `400 Bad Request` response: {"__type":"UsernameExistsException","message":"User already exists"} in /app/public/.../vendor/pmill/aws-cognito/src/Exception/CognitoResponseException.php on line 28

Why get_class in exception ?

aws-cognito/src/Exception/CognitoResponseException.php

Line 16 in 642fece

parent::__construct(get_class(), 0, $previous);

Why not get_called_class() ?
with get_class() result is always CognitoResponseException

Last Api version lacking of handleAuthenticateResponse

Hello @pmill,

I have installed your api via composer two days before and I am wondered that handleAuthenticateResponse() is not in CognitoClient class ?

file_get_contents in function downloadJwtWebKeys

I get a timeout when trying to get jwks.json. I think its because of file_get_contents. With curl_exec it does work. Could it be the problem, that I am behind a proxy? Maybe we should than give the possibility to define a proxy maybe via config.php and use it in file_get_contents.

refreshAuthentication.php example gives "Unable to verify secret hash for client"

I can get all the other example scripts working as expected but refreshAuthentication.php doesn't seem to work for me....

>php login.php
array(5) {
  'AccessToken' =>
  string(1002) "eyJraWQiO<snip>nG_z1g"
  'ExpiresIn' =>
  int(3600)
  'TokenType' =>
  string(6) "Bearer"
  'RefreshToken' =>
  string(1785) "eyJjdHki<snip>K70c4aQ"
  'IdToken' =>
  string(958) "eyJraWQiOiJOd1B<snip>OUAKuyODEPuw"
}

I then edit refreshAuthentication.php and put in the same value for $username as I used in login.php and with $refreshToken set to the RefreshToken I received above (starting eyJjd and ending 4aQ) and I get...

>php refreshAuthentication.php

Fatal error: Uncaught exception 'Aws\CognitoIdentityProvider\Exception\CognitoIdentityProviderException' with message 'Error executing "AdminInitiateAuth" on "https://cognito-i
dp.eu-west-2.amazonaws.com"; AWS HTTP error: Client error: `POST https://cognito-idp.eu-west-2.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"NotAuthorizedException","message":"Unable to verify secret hash for client 2od40<snip>rf9crnnej"}
 NotAuthorizedException (client): Unable to verify secret hash for client 2od40<snip>rf9crnnej - {"__type":"NotAuthorizedException","message":"Unable to verify secret has
h for client 2od40<snip>rf9crnnej"}'

GuzzleHttp\Exception\ClientException: Client error: `POST https://cognito-idp.eu-west-2.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"NotAuthorizedException","message":"Unable to verify secret hash for client 2od40<snip>rf9crnnej"}
 in C:\Users\Ben Kennish\Documents\aws-cognito\vendor\aws\aws-sdk-php\src\WrappedHttpHandler.php on line 195

Aws\CognitoIdentityProvider\Exception\CognitoIdentityProviderException: Error executing "AdminInitiateAuth" on "https://cognito-idp.eu-west-2.amazonaws.com"; AWS HTTP error: Cl
ient error: `POST https://cognito-idp.eu-west-2.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"NotAuthorizedException","message":"Unable to verify secret hash for client 2od40<snip>rf9crnnej"}
 NotAuthorizedException (client): Unable to verify secret hash for client 2od40<snip>rf9crnnej - {"__type":"NotAuthorizedException","message":"Unable to verify secret has
h for client 2od40<snip>rf9crnnej"} in C:\Users\Ben Kennish\Documents\aws-cognito\vendor\aws\aws-sdk-php\src\WrappedHttpHandler.php on line 195

Call Stack:
    0.0005     398744   1. {main}() C:\Users\Ben Kennish\Documents\aws-cognito\examples\refreshAuthentication.php:0
    0.0808    6515504   2. pmill\AwsCognito\CognitoClient->refreshAuthentication() C:\Users\Ben Kennish\Documents\aws-cognito\examples\refreshAuthentication.php:8

This is the same exception message that login.php generates if the 'app_client_secret' in config.php is incorrect but it IS currently correct as login.php is working as expected.

Anyone know what I'm doing wrong?
Cheers, Ben

Failed to connect to cognito-idp.ap-south-1.amazonaws.com port 80: Timed out

.......(transfer 0xc279a10) * Expire in 9 ms for 1 (transfer 0xc279a10) * Trying 13.235.230.89... * TCP_NODELAY set * Expire in 74986 ms for 3 (transfer 0xc279a10) * Expire in 200 ms for 4 (transfer 0xc279a10) * connect to 13.235.230.89 port 80 failed: Timed out * Trying 13.234.154.127... * TCP_NODELAY set * Expire in 64386 ms for 3 (transfer 0xc279a10) * connect to 13.234.154.127 port 80 failed: Timed out * Failed to connect to cognito-idp.ap-south-1.amazonaws.com port 80: Timed out * Closing connection 0 <- Leaving step sign, name 'signer' ----------------------------------- error was set to

this type of error generate while signUp new user

No Example Folder is created?

When I run composer require pmill/aws-cognito, there is no example folder in the project. Can u help?

authenticateUser without AWS credentials

Hi all!

I'm developing an application with the Filemaker API.
Authentication tokens are required and Filemaker Cloud uses Cognito to fetch the correct tokens.

A javascript howto : https://help.claris.com/en/customer-console-help/content/create-fmid-token.html

I've tested this and the javascript example is working.

But I can't get this to work with the aws-cognito implementation, AWS credentials are needed.

Anyone who knows where I should start looking? I've tested the authenticate of the CognitoClient.
But I get an unauthenticated result (403). It seems that the PHP SDK isn't working without credentials provided (as in the javascript example).

Thanks!

Authenticate method does not handle challenge responses

Library should handle Cognito challenge responses for things like 'NEW_PASSWORD_REQUIRED', 'SMS_MFA', etc. The 'authenticate' method currently only deals with a positive authentication response, but masks any requests from Cognito for additional information making it look like the authentication failed.

Details for response types is here: http://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html#API_AdminInitiateAuth_ResponseSyntax

I produced the first case by adding a user to my new user pool from the Cognito user pool dashboard and setting a temporary password for the user.

Here is what the response looked like for that case:

Adding users when Cognito set to: Only allow administrators to create users

Hi,
When Cognito is set to 'Only allow administrators to create users', and running the registerUser.php script I get this error:
PHP Fatal error: Uncaught exception 'Aws\\CognitoIdentityProvider\\Exception\\CognitoIdentityProviderException' with message 'Error executing "SignUp" on "https://cognito-idp.eu-west-2.amazonaws.com"; AWS HTTP error: Client error: POST https://cognito-idp.eu-west-2.amazonaws.com` resulted in a 400 Bad Request response:\n{"__type":"NotAuthorizedException","message":"SignUp is not permitted for this user pool"}\n NotAuthorizedException (client): SignUp is not permitted for this user pool - {"__type":"NotAuthorizedException","message":"SignUp is not permitted for this user pool"}'\n\nGuzzleHttp\Exception\ClientException: Client error: POST https://cognito-idp.eu-west-2.amazonaws.com resulted in a 400 Bad Request response:\n{"__type":"NotAuthorizedException","message":"SignUp is not permitted for this user pool"}\n in /home/ubuntu/vendor/guzzlehttp/guzzle/src/Exception/RequestException.php:113\nStack trace:\n#0 /home/ubuntu/vendor/guzzlehttp/guzzle/src/Middleware.php(65): GuzzleHttp\Exception\RequestException::create(Object(GuzzleHtt in /home/ubuntu/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 192`

When running with Allow users to sign up it works fine and user is added.

I don't want users to signup themselves, only myself, but the process is automated using this script to complete the process, as they have to be verified first as a client already in out system.

Thanks for any help on this.

php8 compatibility

Hi,

Is there a way to update this for php8? Php 8 gives a lot of trouble. Hope someone can help me out with this

Logout functionality

Hello,

How can I implement Logout function? and isAuthenticated function?

regards,

User variables must be strings during sign up

Signup request throws a serialization exception when ints are passed as user variables. (class com.amazon.coral.value.json.numbers.TruncatingBigNumber can not be converted to an String). Even when the user variable is defined as an int in the Cognito user pool.

Casting (string) before passing to your registerUser function fixes the issue. Perhaps your variables loop can just cast each variable to string? Or is that a bad idea?

Convert JWK to public key string PEM/RSAKey

Hello,
Is there a possibility to create public key string .PEM from JWK. I used before Jose\KeyConverter\RSAKey but I deleted this library because of conflict.?

Any suggestion?

thanks

How to get exception message

got this when doing registerUser

(Uncaught GuzzleHttp\Exception\ClientException: Client error: `POST https://cognito-idp.eu-west-2.amazonaws.com` resulted in a `400 Bad Request` response: {"__type":"InvalidPasswordException","message":"Password did not conform with policy: Password must have lowercase chara (truncated...) )
in ...vendor\pmill\aws-cognito\src\Exception\CognitoResponseException.php on line 28

How to get "message":"Password did not conform with policy: Password must have.... message ?

Always obtain NotAuthorizedException - Invalid usernarme or password

Hi!
I don't know what I'm doing wrong, but I always obtain Always obtain NotAuthorizedException - Invalid usernarme or password when I run login.php
I can create an user and confirm it, but when I try to login, I always obtain this error.
Please help me!
Thanks!!!!

Invalid Security Token

For Login API getting below error :

Uncaught exception 'Aws\CognitoIdentityProvider\Exception\CognitoIdentityProviderException' with message 'Error executing "AdminInitiateAuth" on "https://cognito-idp.us-east-1.amazonaws.com"; AWS HTTP error: Client error: POST https://cognito-idp.us-east-1.amazonaws.com resulted in a 400 Bad Request response: {"__type":"UnrecognizedClientException","message":"The security token included in the request is invalid."} UnrecognizedClientException (client): The security token included in the request is invalid. - {"__type":"UnrecognizedClientException","message":"The security token included in the request is invalid."}' GuzzleHttp\Exception\ClientException: Client error: POST https://cognito-idp.us-east-1.amazonaws.com resulted in a 400 Bad Request response: {"__type":"UnrecognizedClientException","message":"The security token included in the request is invalid."}

I believe my config setting is correct.

Authentication in PHP

Hi, After Days of researching this is the only example i found AWS cognito in PHP.I don't have very broad knowledge of PHP.but still i don't understand how to create the client Object and how can i give my credentials ( not Clear what to provide). can you please help me with that please..?

Exception: Attempted to call function "gmp_init" from namespace "Jose\Component\Core\Util".

Hello,
after updating the composer, and by calling verifyAccessToken I got the following error:

Attempted to call function "gmp_init" from namespace "Jose\Component\Core\Util".



CRITICAL14:01:47 | php | Call to undefined function Jose\Component\Core\Util\gmp_init()
-- | -- | --
CRITICAL14:01:47 | request | Uncaught PHP Exception Symfony\Component\Debug\Exception\UndefinedFunctionException: "Attempted to call function "gmp_init" from namespace "Jose\Component\Core\Util"." at /home/vagrant/myProject/vendor/web-token/jwt-core/Util/BigInteger.php line 54

do you know why is such error comes?

regards,

adminInitiateAuth returns empty not error

HI,

While trying
$response = $this->client->adminInitiateAuth([]);
the code hangs after this.
Not returning any error also.

Login Users via Facebook Identity Providers

@pmill is there a possibility to login a user using the FB, google account and automatically generate a user account in UserPool?

I have struggled to find such solution in AWS JS but I could not find any concreted implementation.

regards,

Change Spomky-Labs/jose to web-token/jwt-framework

Although updates for Spomky-Labs/jose is guaranteed to end 2018. It is perhaps best to upgrade now that migration shouldn't be difficult.

Migration guide:
https://web-token.spomky-labs.com/migration/spomky-labs-jose/

dependencies are outdated

Is a plan to update web-token/jwt-signature": "^1.0" to version ^2 ?
This affects other packages which are used with this.

Improve aws-cognito performance

Hello @pmill ;

I want to suggest the following improvements :

1. improve verifyAccessToken(): to return the payload completely not only the payload[username], this will help in getting more details about the logged in user like email address ...

2. improve downloadJwtWebKeys(): to return jwtWebKeys. that helps in storing the keys once locally or in our web server and re-use it (instead of caching). And new setter/getter functions for jwtWebKeys may be required for that.

Regards.

Config.php Optional AWS Credentials compared to AWS Amplify Javascript libraries for Cognito

Since AWS credentials key and secret are optional, these fields could be marked as optional and dropped since they otherwise present a security risk being exposed around? Also, the javascript AWS amplify versions of cognito don't have them. So, do we actually need them here?

<?php
return [
     'credentials' =**> [
        'key' => '',
        'secret' => '',
    ],



'region' => '',
'version' => '',
'app_client_id' => '',
'app_client_secret' => '',
'user_pool_id' => '',
];
?>

InvalidParameterException: Invalid attributes given, adress is missing

I get InvalidParameterException: Invalid attributes given, name and adress is missing error when calling respondToNewPasswordRequiredChallenge function