外部身份提供商注册时Cognito默认手机号设置失效问题排查

问题背景 #

Amazon Cognito将phone_number设为必填属性，要求该属性不能为null。已编写Pre Sign-up Lambda触发器，意图为未提供手机号的注册用户设置默认值，但在Azure等外部身份提供商（IDP）注册场景下未生效，触发报错：

Invalid SAML response received: Invalid user attributes: phoneNumbers: The attribute phoneNumbers is required

当前Lambda代码 #

def lambda_handler(event, context):
    print("Pre Signup Congito")

    if event['triggerSource'] == "PreSignUp_ExternalProvider":
        request = event['request']
        user_attributes = request['userAttributes']

        # If no phone number initialize with default number
        if not user_attributes['phone_number']:
            user_attributes['phone_number'] = '+1888888888'
            user_attributes['phone_number_verified'] = 'false'

        request['userAttributes'] = user_attributes
        event['request'] = request

    # Return to Amazon Cognito
    return event

问题分析 #

当前代码的判断逻辑存在缺陷：当外部IDP未返回phone_number属性时，user_attributes字典中根本不存在该键，直接通过user_attributes['phone_number']访问会抛出KeyError，导致Lambda执行失败，无法完成属性填充，最终触发Cognito的必填属性校验报错。

修正后的Lambda代码 #

def lambda_handler(event, context):
    print("Pre Signup Cognito")

    if event['triggerSource'] == "PreSignUp_ExternalProvider":
        request = event['request']
        user_attributes = request['userAttributes']

        # 检查phone_number属性是否存在，或值为空/无效
        if 'phone_number' not in user_attributes or not user_attributes['phone_number']:
            user_attributes['phone_number'] = '+1888888888'
            user_attributes['phone_number_verified'] = 'false'

        request['userAttributes'] = user_attributes
        event['request'] = request

    # 返回给Amazon Cognito
    return event

额外注意事项 #

• 确认Lambda触发器已正确关联到Cognito用户池的Pre sign-up触发节点
• 检查Lambda执行角色权限，确保拥有修改Cognito用户属性的权限
• 可通过CloudWatch日志查看Lambda接收到的event内容，验证外部IDP是否确实未返回phone_number属性

内容的提问来源于stack exchange，提问作者Sharath