amplify-android: no proper error callback triggers for `confirmSignIn()` when incorrect OTP is entered

Hi @sameera26 I am actively looking into this and Will provide an update shortly.

Hi @Domnis that is certainly the kind of information I was looking for and will help me investigate further.

I will get back to you soon.

Hello ! I’m facing the same issue in my project. But I found something that could help to resolve the issue. The Amplify SDK (version 2.8.5 in my case) works as expected only if the flow is configured to accept only 1 attempt. In that case, if the code provide by the user is incorrect, the lambda fill the response object with this values

event.response.issueTokens = false;
event.response.failAuthentication = true;

and in app, method Amplify.Auth.confirmSignIn(challengeResponse) throw an exception NotAuthorizedException(message=Incorrect username or password.).

On the other hand, if our signIn flow is configured to accept multiple attempts, in case of wrong code provide by user, our lambda will the response with

event.response.issueTokens = false;
event.response.failAuthentication = false;
event.response.challengeName = "CUSTOM_CHALLENGE";

to let know we’re still waiting for a correct response and user can still retry for the same last code sent. But in this case, SDK’s method Amplify.Auth.confirmSignIn(challengeResponse) never return a response nor throw an exception, so app stay in pending result state.

As noted in first post, iOS SDK have fix this issue. I also found this ticket https://github.com/aws-amplify/aws-sdk-android/issues/2653 which seems to be related to this issue.

The code is merged in @sameera26 tracking for release this week. Once released I will communicate here with the release version. Thank you.

The fix is present in release 2.10.0. Please update and let us know if you have any issues. I will keep this ticket open for a week in case there are any issues.

Friendly follow-up on my previous comment.

Hi @gpanshu I have the same issue as @sameera26. I used CUSTOM_AUTH_WITHOUT_SRP auth flow and has no response after calling confirmSignIn with incorrect OTP code. However the auth flow would be triggered AuthSignInStep.DONE as expected and signed in successfully if I entered a correct OTP code.

Here is my pseudocode and logs:

   suspend fun signIn(
        account: String
    ) = suspendCancellableCoroutine<CognitoAuthResult> { continuation ->
        Timber.i("Ready to sign in: $account")
        Amplify.Auth.signIn(
            account,
            null,
            AWSCognitoAuthSignInOptions.CognitoBuilder()
                .authFlowType(AuthFlowType.CUSTOM_AUTH_WITHOUT_SRP)
                .build(),
            {
                Timber.i("signIn ${it.nextStep.additionalInfo?.get("USERNAME")} ${it.nextStep.additionalInfo?.get("XXXX")}")
                continuation.resume(
                    CognitoAuthResult(
                        it.isSignedIn,
                        it.nextStep.additionalInfo?.get("USERNAME") ?: "",
                        it.nextStep.additionalInfo?.get("XXXX") ?: ""
                    )
                )
            },
            {
                continuation.cancel(it)
                Timber.e(it)
            }
        )
    }

   suspend fun confirmSignIn(
        challengeCode: String,
        XXXX: String,
        YYYY: String
    ) = suspendCancellableCoroutine<CognitoAuthResult> { continuation ->
        Timber.i("confirmSignIn input: $challengeCode")
        Amplify.Auth.confirmSignIn(
            challengeCode,
            AWSCognitoAuthConfirmSignInOptions.builder()
                .metadata(
                    mapOf(
                        "XXXX" to XXXX,
                        "YYYY" to YYYY
                    )
                )
                .build(),
            {
                Timber.i("confirmSignIn result: $it")
                continuation.resume(
                    CognitoAuthResult(
                        it.isSignedIn,
                        "",
                        serviceSessionId
                    )
                )
            },
            {
                Timber.e(it)
                continuation.cancel(it)
            }
        )
    }

2023-04-28 13:47:34.686 CognitoLoginDelegate    com.example.ininmm                    I  Ready to sign in: 0988556687_TW
2023-04-28 13:47:37.254 CognitoLog...ate$signIn com.example.ininmm                    I  signIn 0988556687_TW 644b5df9af9285befe702d47
2023-04-28 13:47:41.685 CognitoLoginDelegate    com.example.ininmm                    I  confirmSignIn input: 000000