burnt moat
I'm setting up an Authenticator with an Angular frontend, connecting it to a Cognito user pool. The goal is to migrate existing users to Cognito, send them a temporary password, and let them choose their preferred MFA method during their first login.
The issue is that users are only given the option to configure TOTP for MFA after setting up their new password. There's no option to set up SMS OTP.
Has anyone encountered this or know how to resolve it?
Steps to reproduce:
- Create a user pool with MFA set to "required" and enable both SMS and TOTP.
- Create a new user using the AdminCreateUser method, but don't provide a mobile number.
- Log in with the temporary password using the Amplify Authenticator.
- Set a new password.
- After setting the password, only the TOTP setup is displayed, and there's no option to configure SMS OTP by adding a mobile number.
The behaviour is the same for both React and Angular.
However, the hosted UI allows users to choose between SMS and TOTP setup.
glass cosmos