How to disable AWS Cognito User Pool account created via Identity Provider?

Question

Any Cognito User Pool gurus out there? I've been using Cognito for a while now but this one has me a bit stumped.

• We allow users to sign up and sign in using social accounts like Facebook which are set up as Identity Providers in the User Pool.

• Users need to complete a custom registration form before they can use the main app - we don't use the hosted UI for login or signup

• One step of the custom registration process allows the user to indicate which social provider then want to use

• This allows us to pull back the users email, first and last names from the social provider which is great - we use a cognito client and callback to do this currently

• But in doing so, this provisions a user within the Userpool before the registration process is complete - in fact this makes sense- in order for Cognito to provide us the user info it needs to have called into the social providers /userinfo endpoint to populate the user data

• So, the issue we now have is that whilst the user is half way through the registration process I have a confirmed user account - eg. before the user has completed the registration process

• This is an issue because a user could sign into the the app using their social login without ever have completed the registration process

So as I see it I have two options:

• PostConfirmation Lambda trigger which uses the cognito-idp SDK to disable the user just after it was confirmed
• Don't use Cognito to obtain the user info like firstname, lastname, email, picture etc - however this would require us to write a solution for every current and future social provider which isn't something I'm keen on

Am I missing something obvious?

Thanks in advance!

Answer 1

The simplest solution in the end for us was a Pre Token Generation Trigger in Cognito like this:

exports.handler = async (event) => {

  if(event.triggerSource==="TokenGeneration_HostedAuth") {

     //check db/api etc to see if we have a valid registration stored for user
     if(!hasCompletedRegistration) {

       //throw auth exception which we can catch on the frontend to inform user
       throw new Error("REGISTRATION_NOT_COMPLETE")
     }
  }

  return event

};

For username/password sign ins the TriggerSource will be TokenGeneration_Authentication

For federated/social sign ins the TriggerSource will be TokenGeneration_HostedAuth