Pre authentication Lambda trigger

Amazon Cognito invokes this trigger when a user attempts to sign in, allowing custom validation to accept or deny the authentication request.

Note

Triggers are dependant on the user existing in the user pool before trigger activation.

Pre authentication Lambda flows

Client authentication flow

Server authentication flow

The request includes validation data from the client which comes from the ClientMetadata values passed to the user pool InitiateAuth and AdminInitiateAuth API methods.

For more information, see User pool authentication flow.

Pre authentication Lambda trigger parameters

These are the parameters required by this Lambda function in addition to the common parameters.

JSON

{
    "request": {
        "userAttributes": {
            "string": "string",
            . . .
        },
        "validationData": {
            "string": "string",
            . . .
        },
        "userNotFound": boolean
    },
    "response": {}
}

Pre authentication request parameters

userAttributes

One or more name-value pairs representing user attributes.

userNotFound

This boolean is populated when PreventUserExistenceErrors is set to ENABLED for your User Pool client.

validationData

One or more key-value pairs containing the validation data in the user's sign-in request. You can pass this data to your Lambda function by using the ClientMetadata parameter in the InitiateAuth and AdminInitiateAuth API actions.

Pre authentication response parameters

No additional return information is expected in the response.

Authentication tutorials

The pre authentication Lambda function is triggered just before Amazon Cognito signs in a new user. See these sign-in tutorials for JavaScript, Android, and iOS.

Platform	Tutorial
JavaScript Identity SDK	Sign in users with JavaScript
Android Identity SDK	Sign in users with Android
iOS Identity SDK	Sign in users with iOS

Pre authentication example

This sample function prevents users from a specific user pool app client to sign-in to the user pool.

Node.js

exports.handler = (event, context, callback) => {
    if (event.callerContext.clientId === "user-pool-app-client-id-to-be-blocked") {
        var error = new Error("Cannot authenticate users from this user pool app client");

        // Return error to Amazon Cognito
        callback(error, event);
    }

    // Return to Amazon Cognito
    callback(null, event);
};

Python

def lambda_handler(event, context):
    if event['callerContext']['clientId'] == "<user pool app client id to be blocked>":
        raise Exception("Cannot authenticate users from this user pool app client")

    # Return to Amazon Cognito
    return event

Amazon Cognito passes event information to your Lambda function. The function then returns the same event object back to Amazon Cognito, with any changes in the response. In the Lambda console, you can set up a test event with data that’s relevant to your Lambda trigger. The following is a test event for this code sample:

JSON

{
    "callerContext": {
        "clientId": "<user pool app client id to be blocked>"
    },
    "response": {}
}