如何在 WinUI 3 应用程序中获取 AccessToken 或 Session 字符串以启动 AWS Cognito MFA 的设置

Question

I am building WinUI 3 desktop app which uses AWS Cognito for user sign-up/sign-in and I came across a problem when trying to implement MFA set up after user creation.

According to AWS documentation I need to call AssociateSoftwareToken with AssociateSoftwareTokenRequest parameter and its "Access Token" or "Session String" properties set to authorize the request:

https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/CognitoIdentityProvider/MCognitoIdentityProviderAssociateSoftwareTokenAsyncAssociateSoftwareTokenRequestCancellationToken.html

https://docs.aws.amazon.com/sdkfornet/v3/apidocs/items/CognitoIdentityProvider/TAssociateSoftwareTokenRequest.html

My question is - how can I get the AccessToken or Session string from my preceding sign-in request to then authorize AssociateSoftwareToken in WinUi 3 desktop app?

I've googled around and read AWS and MS docs but cannot find anything helpful in this regard.

My code snippets:

1. User sign-in method:

        try
        {
            AmazonCognitoIdentityProviderClient provider = new(new AnonymousAWSCredentials(), FallbackRegionFactory.GetRegionEndpoint())
            CognitoUserPool cognitoUserPool = new(poolID, clientID, provider);
            CognitoUser cognitoUser = new(username, clientID, cognitoUserPool, provider);
            InitiateSrpAuthRequest authRequest = new()
            {
                Password = password
            };
            AuthFlowResponse authFlowResponse = await cognitoUser.StartWithSrpAuthAsync(authRequest).ConfigureAwait(false);

            if (authFlowResponse.AuthenticationResult is null)
            {  
                if (authFlowResponse.ChallengeName == ChallengeNameType.MFA_SETUP)
                {
                   //At this point I need AccessToken or Session string to to call CognitoSetUpTOTPMFAAsync(string accessToken) to trigger MFA setup...
                }
                .
                //remaining implementation
                .
            }
            return ...
        }
        catch (Exception e)
        {
            return ...
        }

2. CognitoSetUpTOTPMFAAsync(string accessToken OR string sessionString)

        try
        {
            
            AmazonCognitoIdentityProviderClient provider = new(new AnonymousAWSCredentials(), FallbackRegionFactory.GetRegionEndpoint());
            AssociateSoftwareTokenRequest associateSoftwareTokenRequest = new()
            {
                AccessToken = accessToken,
                Session = sessionString               
            };
            AssociateSoftwareTokenResponse associateSoftwareTokenResponse = await provider.AssociateSoftwareTokenAsync(associateSoftwareTokenRequest);
            .
            //remaining implementation
            .
            return ...
        }
        catch (Exception)
        {
            return ...
        }

Answer 1

Turns out the required "Session string" is returned after initial sign in request in AuthFlowResponse object as SessionID parameter. It is contained in each response from Cognito and can be used to supply with consecutive requests.

Adding this to my code:

...
AuthFlowResponse authFlowResponse = await cognitoUser.StartWithSrpAuthAsync(authRequest);
var sessionId = authFlowResponse.SessionID;
...

Then provide sessionId to MFA setup AssociateSoftwareTokenRequest request:

...
AssociateSoftwareTokenRequest associateSoftwareTokenRequest = new()
   {
   Session = sessionId                
   };
AssociateSoftwareTokenResponse associateSoftwareTokenResponse = await provider.AssociateSoftwareTokenAsync(associateSoftwareTokenRequest);
...

Then associateSoftwareTokenResponse contains SecretCode value to be used to register with authenticator app.