`Auth.confirmSignIn` throws `UserNotFoundException` upon SMS code confirm

Describe the bug I am attempting to implement SMS MFA with the API directly (not aws-amplify-react-native Components). After setting up the MFA as described below, I sign out of the User, sign back in, receive the SMS code, and try to confirm it. Instead of succeeding, Auth.confirmSignIn throws a UserNotFoundException.

To Reproduce Steps to reproduce the behavior:

1. Sign into a Cognito account that does not yet have MFA set up.

const user = await Auth.signIn(username, password);

1. We have signed into the user. Our tokens are there, our account shows up in the User pool list. The user absolutely exists.
2. Get 10-digit phone number from input, set up MFA with

const phone = '5553334444';
const user = await Auth.currentAuthenticatedUser();
const result = await Auth.updateUserAttributes(user, {
    phone_number: `+1${phone}`,     
});
await Auth.setPreferredMFA(user, 'SMS');

1. Sign out

Auth.signOut();

1. Sign back in

const user = await Auth.signIn(username, password);

1. Ding ding ding! We get user.challengeName === 'SMS_MFA'.
2. Ring ring ring! Code shows up via SMS.
3. Let’s confirm sign in.

await Auth.confirmSignIn(user, code, 'SMS_MFA');

1. Boom! An error object is thrown:

Object { code: "UserNotFoundException", name: "UserNotFoundException", message: "User does not exist." }

1. We are not signed in.

Expected behavior Confirm SMS code, sign into User.

Screenshots None

Smartphone (please complete the following information):

• OS: Android 8.0
• Platform: react-native
• Versions: react-native@0.59.5, aws-amplify@1.1.29

Additional context Here is some Auth related configuration relevant to our user pool:

• MFA is set to Optional.
• We are using a UserMigration Lambda, and therefore use authenticationFlowType: 'USER_PASSWORD_AUTH'
• The Lambda imports relevant attributes, but NOT phone_number and phone_number_verified remains false throughout.
• Users have phone_number write permissions for all App clients.

[EJRosie]

For anyone else who has this issue, I had a random user sub set as the username in my userpool, but email login. Auth.signIn() for anyone with MFA enabled returns an object with a username of the email, instead of the sub. I fixed this problem by explicitly setting the username of the signIn response to the actual username of the user, which happens to be contained within challengeParam.USER_ID_FOR_SRP

Essentially: var user = await Auth.signIn(email, password); user.username = user.challengeParam.USER_ID_FOR_SRP; await Auth.confirmSignIn(user, code, "SMS_MFA");

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.