AWS Cognito - AdminInitiateAuth vs InitiateAuth

Question

We're looking to leverage AWS Cognito for authentication with an architecture that looks like: client (browser) -> our server -> AWS Cognito

With various configurations set, initiateAuth seems no different to AdminInitiateAuth and so I'd like to understand when under these configurations if it matters whether one is chosen over the other.

It seems that when I create an app with a client secret and use initiateAuth, it seems to be almost the same integration experience as adminInitiateAuth that uses the ADMIN_NO_SRP_AUTH auth flow. The latter does not even require AWS credentials as stated in the AWS documentation. My integration with Cognito is as below:

initiateAuth:

  const payload = {
    AuthFlow: "USER_PASSWORD_AUTH",
    ClientId: cognitoClientId,
    AuthParameters: {
      USERNAME: username,
      PASSWORD: password,
      SECRET_HASH: generateSignature(username)
    }
  }
  const response = await cognitoClient.initiateAuth(payload).promise();

adminInitiateAuth:

  const payload = { 
    UserPoolId: userPoolId,
    AuthFlow: "ADMIN_NO_SRP_AUTH",
    ClientId: cognitoClientId,
    AuthParameters: {
      USERNAME: username,
      PASSWORD: password,
      SECRET_HASH: generateSignature(username)
    }
  }
  const response = await cognitoClient.adminInitiateAuth(payload).promise();

You can see the difference is the different AuthFlow values, calling different methods and ADMIN_NO_SRP_AUTH requiring the UserPoolId parameter which seems superficial to me.

We are also generating the signature based on the client secret which is something that we would handle securely.

Answer 1

I understand that you would like to know the difference between the InitiateAuth and the AdminInitiateAuth API calls in Amazon Cognito. To clarify the usage of the API calls:

• InitiateAuth is a client/browser side API call, and the API call does not need any sensitive credentials to give a challenge and other parameters.
• AdminInitiateAuth is a meant to be run in the server side, and the API call always needs developer credentials to give a successful response. This is because the API call is an AWS SigV4 signed API call.

Furthermore, both the API calls support different Auth Flows as specified below.

InitiateAuth supports the following Auth Flows:

• USER_SRP_AUTH
• REFRESH_TOKEN_AUTH
• USER_PASSWORD_AUTH
• CUSTOM_AUTH

Kindly note that the AWS CLI documentation [a] currently states that ADMIN_NO_SRP_AUTH is a possible value. However, I have tested the API call on my end and I can confirm that the documentation for the CLI is currently incorrect.

UPDATE (12/09/2019): It looks like after this answer was written, Amazon Web Services has updated their documentation to the correct possible values. The documentation now states the following:

ADMIN_NO_SRP_AUTH is not a valid value.

AdminInitiateAuth supports the following Auth flows:

• USER_SRP_AUTH
• REFRESH_TOKEN_AUTH
• CUSTOM_AUTH
• ADMIN_NO_SRP_AUTH
• USER_PASSWORD_AUTH

Example use-case of InitiateAuth: If you want your users to authenticate into your web application.

Example use-case of AdminInitiateAuth: Any use-case that needs server side authentication or access based on specific AWS Credentials to filter that only specific IAM users can authenticate using Cognito.

As stated by george earlier, InitiateAuth would be ideal for your use-case as your application is a client side application. Additionally, if you are concerned about security, you could use the USER_SRP_AUTH with InitiateAuth. For more information about using the USER_SRP_AUTH flow in your production code, you could refer to the following NPM documentation[b].

References

[a]. https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/initiate-auth.html

[b]. https://www.npmjs.com/package/cognito-srp