CognitoIdentityProvider / Client / admin_disable_provider_for_user
admin_disable_provider_for_user#
- CognitoIdentityProvider.Client.admin_disable_provider_for_user(**kwargs)#
Prevents the user from signing in with the specified external (SAML or social) identity provider (IdP). If the user that you want to deactivate is a Amazon Cognito user pools native username + password user, they can’t use their password to sign in. If the user to deactivate is a linked external IdP user, any link between that user and an existing user is removed. When the external user signs in again, and the user is no longer attached to the previously linked
DestinationUser
, the user must create a new user account. See AdminLinkProviderForUser.The
ProviderName
must match the value specified when creating an IdP for the pool.To deactivate a native username + password user, the
ProviderName
value must beCognito
and theProviderAttributeName
must beCognito_Subject
. TheProviderAttributeValue
must be the name that is used in the user pool for the user.The
ProviderAttributeName
must always beCognito_Subject
for social IdPs. TheProviderAttributeValue
must always be the exact subject that was used when the user was originally linked as a source user.For de-linking a SAML identity, there are two scenarios. If the linked identity has not yet been used to sign in, the
ProviderAttributeName
andProviderAttributeValue
must be the same values that were used for theSourceUser
when the identities were originally linked usingAdminLinkProviderForUser
call. (If the linking was done withProviderAttributeName
set toCognito_Subject
, the same applies here). However, if the user has already signed in, theProviderAttributeName
must beCognito_Subject
andProviderAttributeValue
must be the subject of the SAML assertion.Note
Amazon Cognito evaluates Identity and Access Management (IAM) policies in requests for this API operation. For this operation, you must use IAM credentials to authorize requests, and you must grant yourself the corresponding IAM permission in a policy.
Learn more
See also: AWS API Documentation
Request Syntax
response = client.admin_disable_provider_for_user( UserPoolId='string', User={ 'ProviderName': 'string', 'ProviderAttributeName': 'string', 'ProviderAttributeValue': 'string' } )
- Parameters:
UserPoolId (string) –
[REQUIRED]
The user pool ID for the user pool.
User (dict) –
[REQUIRED]
The user to be disabled.
ProviderName (string) –
The name of the provider, such as Facebook, Google, or Login with Amazon.
ProviderAttributeName (string) –
The name of the provider attribute to link to, such as
NameID
.ProviderAttributeValue (string) –
The value of the provider attribute to link to, such as
xxxxx_account
.
- Return type:
dict
- Returns:
Response Syntax
{}
Response Structure
(dict) –
Exceptions
CognitoIdentityProvider.Client.exceptions.ResourceNotFoundException
CognitoIdentityProvider.Client.exceptions.InvalidParameterException
CognitoIdentityProvider.Client.exceptions.TooManyRequestsException
CognitoIdentityProvider.Client.exceptions.NotAuthorizedException
CognitoIdentityProvider.Client.exceptions.UserNotFoundException
CognitoIdentityProvider.Client.exceptions.AliasExistsException
CognitoIdentityProvider.Client.exceptions.InternalErrorException