Authentication failed not handling nested challenges

Utilizing the develop branch commit a53cb082b6a07f32ddc5c9cacff6f5dfe926f170

Using this code which seems to be entirely correct doesn’t seem to authenticate correctly

    config = ce.get_config('Cognito', args.configfile)
    u = Cognito(config['pool_id'],config['client_id'], username=args.username)
    response = u.authenticate(args.password)

2017-04-11 12:24:16 DEBUG parsers.parse Response body:
{"ChallengeName":"NEW_PASSWORD_REQUIRED","ChallengeParameters":{"requiredAttributes":"[]","userAttributes":"{\"email_verified\":\"true\",\"email\":\"<ommitted email>\"}"},"Session":"<sessiong string ommitted>"}
2017-04-11 12:24:16 DEBUG hooks._emit Event needs-retry.cognito-idp.RespondToAuthChallenge: calling handler <botocore.retryhandler.RetryHandler object at 0x7fc01d531d90>
2017-04-11 12:24:16 DEBUG retryhandler.__call__ No retry needed.
Traceback (most recent call last):
  File "bin/auth-cognito", line 37, in <module>
    main()
  File "bin/auth-cognito", line 33, in main
    response = u.authenticate(args.password)
  File "~/.local/lib/python2.7/site-packages/warrant/__init__.py", line 213, in authenticate
    self.id_token = tokens['AuthenticationResult']['IdToken']
KeyError: 'AuthenticationResult'

It doesn’t look like there is support for Challenges of NEW_PASSWORD_REQUIRED and it failed to raise like it should https://github.com/capless/warrant/blob/develop/warrant/aws_srp.py#L187

[armicron]

The current state:

• Warrant raises ForceChangePasswordException for users which are required to change their passwords after successful first login (NEW_PASSWORD_REQUIRED challenge).

• new_password_challenge method is not documented

• Warrant raises NotImplementedError when a challenge is not supported.

• Warrant doesn’t support SMS_MFA, CUSTOM_CHALLENGE, DEVICE_SRP_AUTH DEVICE_PASSWORD_VERIFIER challenges.

The first post says about the problem with the NEW_PASSWORD_REQUIRED challenge only and this issue is fixed. The title has more broad meaning, it implies that warrant should support all challenges.

@bjinwright The decision of closing the issue depends on what to take into account: the title or the first post.

[ebpetway]

Looks like it assumes there will only be one response challenge. We’ll need to add the ability to complete the challenge with an additional input (the new password).