Use Cognito Forgot password cannot receive any code with Email

Question

I m the first time on use the AWS Cognito Auth.

1. created a User Pool (succeed)
2. use AdminCreateUser API to create a user in pool (succeed)
3. try to use AdminInitiateAuth API and AdminRespondToAuthChallenge API to got a access token (succeed)
4. try to use ForgotPassword API to reset password, but it does not work at all.

here is my code for ForgotPassword in JAVA:

ForgotPasswordRequest request = ForgotPasswordRequest.builder()
  .clientId(GetUserPoolClientId(companyCode))
  .username(userEmail)
  .build();
ForgotPasswordResponse response = cognitoClient.forgotPassword(request);

the response give me ***@gmail.com, but I do not receive any emails.

Answer 1

I've been struggling with this for a couple of days now but finally found an answer. It seems that we can't send forgotPassword email to a user that doesn't have the email verified, and that can happen when you use the AdminCreateUser API since user only receives the email for temporary password and not for email verification.

Verification of a phone or email is necessary to automatically confirm users and enable recovery from forgotten passwords.

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-email-phone-verification.html?icmpid=docs_cognito_console

Solution:

When you call the AdminCreateUser method you can actually pass the email verified flag as another attribute:

{
  //AminCreateUser request ...
  "UserAttributes": [
    // other user attributes ...
    { 
     "Name": "email_verified",
     "Value": "true"
    }
  ],
}

It should also be possible to update the email_verified status with the AdminUpdateUserAttributes API.