Auth.forgotPassword does not work when user account status is "FORCE_CHANGE_PASSWORD"

This might be a duplicate of 1182.

When a user is created through the JS/Node SDK using AdminCreateUser, they get an email with a temporary password. We have a common issue where a user does not log in before their temporary password expires or the user cannot find the email.

When a new user is created their “Account Status” is 'FORCE_CHANGE_PASSWORD' and we are setting email_verified to true.

It appears there is no way to reset the password using Amplify.Auth.forgotPassword. Unfortunately this puts us in a position where we have to resend the email through the CLI or manually reset the password in the AWS Console.

Ideally a user would be able to reset their password if their email is verified.

[elorzafe]

@alspdx according to cognito docs.

The temporary password can only be used until the user account expiration limit that you specified when you created the user pool. To reset the account after that time limit, you must call AdminCreateUser again, specifying “RESEND” for the MessageAction parameter.

Currently there is no option for the library to do this. Is a server side problem that could implemented using a lambda function.

I will close this issue because a duplicate from #1182

We have an open RFC for auth enhancements here feel free to add this request or comments.

Thanks for your feedback!

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels or Discussions for those types of questions.