title: AWS Cognito Workflow: Using email alias for primary username
body: <p>So I am trying to get my head around AWS Cognito but I have hit some walls.</p>
  
  <p>So, right now I can register an account, and verify it and sign in. Simple enough. The edge cases are where my walls are.</p>
  
  <p>Here's the info I have so far:</p>
  
  <ul>
  <li><code>username</code>'s cannot be changed once created</li>
  <li>I am using UUIDs as my <code>username</code> values</li>
  <li><code>email</code> is marked as an <strong>alias</strong>, which in Cognito terms means I can use it to sign in with in addition to <code>username</code>.</li>
  <li><p>if <code>email</code> is chosen as an <strong>alias</strong>, per the docs, the same value cannot be used as the username (<a href="http://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases" rel="noreferrer">http://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases</a>):</p>
  
  <blockquote>
    <p>If email is selected as an alias, a username cannot match a valid email format. Similarly, if phone number is selected as an alias, a username that matches a valid phone number pattern will not be accepted by the service for that user pool.</p>
  </blockquote></li>
  <li><p>The <code>email</code> address can <strong>ONLY</strong> be used to sign in once the account has been <strong>verified</strong> (<a href="http://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases" rel="noreferrer">http://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases</a>)</p>
  
  <blockquote>
    <p>Phone numbers and email addresses only become active aliases for a user after the phone numbers and email addresses have been verified. We therefore recommend that you choose automatic verification of email addresses and phone numbers if you choose to use them as aliases.</p>
  </blockquote></li>
  </ul>
  
  <p>Here in lies my edge case.</p>
  
  <p>If a user signs up, but does <strong>NOT</strong> immediately verify: </p>
  
  <ul>
  <li>they get called away</li>
  <li>maybe the app crashes</li>
  <li>they lose connectivity </li>
  <li>their battery dies</li>
  <li>they force quit</li>
  <li>app get's accidentally deleted. </li>
  </ul>
  
  <p>In their mind they have signed up just not verified their account. At this point it effectively leaves no way to verify their account they thought they signed up for. I guess it could be solved with messaging: </p>
  
  <p>"Warning your account will not be created until you verify your email address." or something along those lines. Anyway... </p>
  
  <ul>
  <li>They can't attempt to sign in as they won't know the UUID that was randomly assigned as their <code>username</code>. </li>
  <li>Even if that wasn't the case, they provided their email address as their username. From the user's POV they would have no idea what their <code>username</code> could even be since they only entered their email address.</li>
  <li>The best they could hope for is to try to sign up again. (Assuming they read the verification warning above) In this case now Cognito potentially has abandoned <strong>unconfirmed</strong> accounts piling up. </li>
  </ul>
  
  <p>"Piling up" may be too strong a phrase, this is likely a pretty fringe case.</p>
  
  <p>Now the plus side is, since they have not "verified" their <code>email</code> they can sign up again with the same <code>email</code> address since the <code>email</code> doesn't get uniquely constrained until it's <code>verified</code>. If someone tries to verify an address that has already been verified they get a <code>AliasExistsException</code>. This actually brings up an interesting point which I just tested as well. </p>
  
  <p>I can register with an email address, then verify that email address so the account becomes confirmed. I can then turn right around and sign up with the <strong>same</strong> email address and I don't get an official AWS error until I try go to verify that account with the duplicate email address. There isn't any way to surface this error earlier? I guess the expectation is that it's on the developer to write a verification service in the Pre-Signup Trigger:</p>
  
  <blockquote>
    <p>This trigger is invoked when a user submits their information to sign up, allowing you to perform custom validation to accept or deny the sign up request.</p>
  </blockquote>
  
  <p>To sum up, and to restate the question:</p>
  
  <p>It seems to be <strong>required</strong>, practically speaking, that when using an email address with Cognito a Pre-Signup Lambda is required to ensure an account with an email doesn't already exist since the AWS Exception won't be handled until a verification attempt is made. </p>
  
  <p>Is my assumption here correct?  By <strong>required</strong> here I think it's pretty reasonable to let a user know an email address is not available as soon as possible. For example: </p>
  
  <pre><code>John Doe : jdoe@gmail.com
  Jane Doe : jdoe@gmail.com
  </code></pre>