title: Amplify CUSTOM_AUTH along with username/password is failing with NotAuthorizedException
body: <p>I am trying to do a username/password login with custom email OTP using CUSTOM_AUTH (amplify js library from a vuejs application)</p>
  <p>I have set authenticationFlowType to CUSTOM_AUTH</p>
  <p>Below are the steps -</p>
  <ol>
  <li>Auth.signIn(username, password)</li>
  <li>This executes the first 2 cases of define auth challange lambda
  trigger</li>
  <li>The input json to define auth challange lambda looks like this</li>
  </ol>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>{
  challengeName: 'SRP_A',
  challengeResult: true,
  challengeMetadata: null
  },
  {
  challengeName: 'PASSWORD_VERIFIER',
  challengeResult: true,
  challengeMetadata: null
  }</code></pre>
  </div>
  </div>
  </p>
  <ol start="4">
  <li>Its clear that password is validated.</li>
  <li>It now sets the challange to CUSTOM_CHALLANGE.</li>
  <li>At this point the client fails with NotAuthorizedException (Incorrect username or password) instead
  of  asking for the challange answer.</li>
  </ol>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>My define auth challange lambda is like this -
  
  exports.handler = async (event, context) =&gt; {
  console.log(event.request.session)
  if (event.request.session.length == 1 &amp;&amp; event.request.session[0].challengeName == 'SRP_A') {
  event.response.issueTokens = false;
  event.response.failAuthentication = false;
  event.response.challengeName = 'PASSWORD_VERIFIER';
  }
  else if (event.request.session.length == 2 &amp;&amp; event.request.session[1].challengeName == 'PASSWORD_VERIFIER' &amp;&amp; event.request.session[1].challengeResult == true) {
  event.response.issueTokens = false;
  event.response.failAuthentication = false;
  event.response.challengeName = 'CUSTOM_CHALLENGE';
  }
  else if (event.request.session.length == 3 &amp;&amp; event.request.session[2].challengeName == 'CUSTOM_CHALLENGE' &amp;&amp; event.request.session[2].challengeResult == true) {
  event.response.issueTokens = true;
  event.response.failAuthentication = false;
  }
  else {
  console.log('Failing Authentication')
  event.response.issueTokens = false;
  event.response.failAuthentication = true;
  }
  context.done(null, event);
  }</code></pre>
  </div>
  </div>
  </p>
  <p>My question is, is this even supported by amplify? If not then is there any other way?</p>
  <p>Documentation referred - <a href="https://docs.amplify.aws/lib/auth/switch-auth/q/platform/js#custom_auth-flow" rel="nofollow noreferrer">https://docs.amplify.aws/lib/auth/switch-auth/q/platform/js#custom_auth-flow</a></p>
  <p>This suggests you to not provide a password but that does not work either.</p>