def admin_initiate_auth(UserPoolId=None, ClientId=None, AuthFlow=None,
    AuthParameters=None, ClientMetadata=None):
    """
    Initiates the authentication flow, as an administrator.
    Requires developer credentials.
    See also: AWS API Documentation
    
    
    :example: response = client.admin_initiate_auth(
        UserPoolId='string',
        ClientId='string',
        AuthFlow='USER_SRP_AUTH'|'REFRESH_TOKEN_AUTH'|'REFRESH_TOKEN'|'CUSTOM_AUTH'|'ADMIN_NO_SRP_AUTH',
        AuthParameters={
            'string': 'string'
        },
        ClientMetadata={
            'string': 'string'
        }
    )
    
    
    :type UserPoolId: string
    :param UserPoolId: [REQUIRED]
            The ID of the Amazon Cognito user pool.
            

    :type ClientId: string
    :param ClientId: [REQUIRED]
            The app client ID.
            

    :type AuthFlow: string
    :param AuthFlow: [REQUIRED]
            The authentication flow for this call to execute. The API action will depend on this value. For example:
            REFRESH_TOKEN_AUTH will take in a valid refresh token and return new tokens.
            USER_SRP_AUTH will take in USERNAME and SRPA and return the SRP variables to be used for next challenge execution.
            Valid values include:
            USER_SRP_AUTH : Authentication flow for the Secure Remote Password (SRP) protocol.
            REFRESH_TOKEN_AUTH /REFRESH_TOKEN : Authentication flow for refreshing the access token and ID token by supplying a valid refresh token.
            CUSTOM_AUTH : Custom authentication flow.
            ADMIN_NO_SRP_AUTH : Non-SRP authentication flow; you can pass in the USERNAME and PASSWORD directly if the flow is enabled for calling the app client.
            

    :type AuthParameters: dict
    :param AuthParameters: The authentication parameters. These are inputs corresponding to the AuthFlow that you are invoking. The required values depend on the value of AuthFlow :
            For USER_SRP_AUTH : USERNAME (required), SRPA (required), SECRET_HASH (required if the app client is configured with a client secret), DEVICE_KEY
            For REFRESH_TOKEN_AUTH/REFRESH_TOKEN : USERNAME (required), SECRET_HASH (required if the app client is configured with a client secret), REFRESH_TOKEN (required), DEVICE_KEY
            For ADMIN_NO_SRP_AUTH : USERNAME (required), SECRET_HASH (if app client is configured with client secret), PASSWORD (required), DEVICE_KEY
            For CUSTOM_AUTH : USERNAME (required), SECRET_HASH (if app client is configured with client secret), DEVICE_KEY
            (string) --
            (string) --
            

    :type ClientMetadata: dict
    :param ClientMetadata: This is a random key-value pair map which can contain any key and will be passed to your PreAuthentication Lambda trigger as-is. It can be used to implement additional validations around authentication.
            (string) --
            (string) --
            

    :rtype: dict
    :return: {
        'ChallengeName': 'SMS_MFA'|'PASSWORD_VERIFIER'|'CUSTOM_CHALLENGE'|'DEVICE_SRP_AUTH'|'DEVICE_PASSWORD_VERIFIER'|'ADMIN_NO_SRP_AUTH'|'NEW_PASSWORD_REQUIRED',
        'Session': 'string',
        'ChallengeParameters': {
            'string': 'string'
        },
        'AuthenticationResult': {
            'AccessToken': 'string',
            'ExpiresIn': 123,
            'TokenType': 'string',
            'RefreshToken': 'string',
            'IdToken': 'string',
            'NewDeviceMetadata': {
                'DeviceKey': 'string',
                'DeviceGroupKey': 'string'
            }
        }
    }
    
    
    :returns: 
    SMS_MFA : Next challenge is to supply an SMS_MFA_CODE , delivered via SMS.
    PASSWORD_VERIFIER : Next challenge is to supply PASSWORD_CLAIM_SIGNATURE , PASSWORD_CLAIM_SECRET_BLOCK , and TIMESTAMP after the client-side SRP calculations.
    CUSTOM_CHALLENGE : This is returned if your custom authentication flow determines that the user should pass another challenge before tokens are issued.
    DEVICE_SRP_AUTH : If device tracking was enabled on your user pool and the previous challenges were passed, this challenge is returned so that Amazon Cognito can start tracking this device.
    DEVICE_PASSWORD_VERIFIER : Similar to PASSWORD_VERIFIER , but for devices only.
    ADMIN_NO_SRP_AUTH : This is returned if you need to authenticate with USERNAME and PASSWORD directly. An app client must be enabled to use this flow.
    NEW_PASSWORD_REQUIRED : For users which are required to change their passwords after successful first login. This challenge should be passed with NEW_PASSWORD and any other required attributes.
    
    """
    pass
