aws-amplify / aws-amplify/amplify-cli

Adding override for supportedIdentityProviders erases all userPoolClient settings

Open
#12,079 2 comments 2 reactions 0 assignees View on GitHub
bug extensibility p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

16.18..1

### Amplify CLI Version

10.7.3

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes, but other overrides in the same file

### Describe the bug

I am trying to add a SAML provider to my cognito user pool after running `amplify override auth`, which works great with the following code:
```js
// override.ts
import { AmplifyAuthCognitoStackTemplate } from "@aws-amplify/cli-extensibility-helper";

export function override(resources: AmplifyAuthCognitoStackTemplate) {
resources.addCfnResource(
{
type: "AWS::Cognito::UserPoolIdentityProvider",
properties: {
UserPoolId: { Ref: "UserPool" },
ProviderName: "Azure",
ProviderDetails: {
MetadataURL:
"https://login.microsoftonline.com//federationmetadata/2007-06/federationmetadata.xml?appid=",
},
ProviderType: "SAML",
AttributeMapping: {
email:
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
},
IdpIdentifiers: ["Azure"],
},
},
"Azure"
);
}
```

The problem then comes in when I try to add the new SAML provider to the User Pool Clients (regular and web) to add the new SAML option to the Hosted UI.

I have tried with the following:
```js
// NOT CORRECT, adds new client, need to modify existing
resources.addCfnResource(
{
type: "AWS::Cognito::UserPoolClient",
properties: {
SupportedIdentityProviders: ["Azure"],
UserPoolId: { Ref: "UserPool" },
},
},
"Add Azure to supportedIdentityProviders"
);

// THROWS ERROR
// Type '{ attrClientSecret: string; attrName: string; userPoolId: string; accessTokenValidity: number; allowedOAuthFlows: string[]; allowedOAuthFlowsUserPoolClient: boolean | IResolvable; ... 21 more ...; node: ConstructNode; }' is missing the following properties from type 'CfnUserPoolClient': inspect, cfnProperties, renderProperties, _cfnProperties, and 27 more.
resources.userPoolClientWeb = {
supportedIdentityProviders: [
"Azure",
...resources.userPoolClientWeb.supportedIdentityProviders,
],
...resources.userPoolClientWeb
};

// THROWS ERROR on amplify push
// resources.userPoolClientWeb.supportedIdentityProviders is not iterable
resources.userPoolClientWeb.supportedIdentityProviders = [
"Azure",
...resources.userPoolClientWeb.supportedIdentityProviders,
];

// ERASES ALL OTHER SUPPORTED IDENTITY PROVIDERS AND OTHER HOSTED UI SETTINGS
resources.userPoolClientWeb.supportedIdentityProviders = ["Azure"];

// ERASES ALL OTHER SUPPORTED IDENTITY PROVIDERS AND OTHER HOSTED UI SETTINGS
const userPoolClientWeb = resources.userPoolClientWeb;
const baseClient = Array.isArray(userPoolClientWeb.supportedIdentityProviders)
? userPoolClientWeb.supportedIdentityProviders
: [userPoolClientWeb.supportedIdentityProviders];
// resources.userPoolClient.addPropertyOverride("SupportedIdentityProviders", [
// ...baseClient,
// "Azure",
// ]);
resources.userPoolClientWeb.supportedIdentityProviders = [
...baseClient,
"Azure",
];
```

I have logged `resources.userPoolClient` and it returns the following, noting the `undefined` in the original `supportedIdentityProviders`:
```bash
userPoolClientWeb: [Circular *1],
userPoolClient: CfnUserPoolClient {
node: [ConstructNode],
stack: [Circular *2],
logicalId: '${Token[AmplifyAuthCongitoStack.UserPoolClient.LogicalID.676]}',
cfnOptions: {},
rawOverrides: {},
dependsOn: [Set],
cfnResourceType: 'AWS::Cognito::UserPoolClient',
_cfnProperties: [Object],
attrClientSecret: '${Token[TOKEN.677]}',
attrName: '${Token[TOKEN.678]}',
userPoolId: '${Token[TOKEN.675]}',
accessTokenValidity: undefined,
allowedOAuthFlows: undefined,
allowedOAuthFlowsUserPoolClient: undefined,
allowedOAuthScopes: undefined,
analyticsConfiguration: undefined,
callbackUrLs: undefined,
clientName: '_app_client',
defaultRedirectUri: undefined,
enablePropagateAdditionalUserContextData: undefined,
enableTokenRevocation: undefined,
explicitAuthFlows: undefined,
generateSecret: '${Token[TOKEN.680]}',
idTokenValidity: undefined,
logoutUrLs: undefined,
preventUserExistenceErrors: undefined,
readAttributes: undefined,
refreshTokenValidity: '${Token[TOKEN.679]}',
supportedIdentityProviders: undefined,
tokenValidityUnits: [Object],
writeAttributes: undefined,
[Symbol(@aws-cdk/core.DependableTrait)]: [Object]
},
```

### Expected behavior

I expected to be able to do one of the previous methods for overriding, either [customizing directly as shown in the docs](https://docs.amplify.aws/cli/auth/override/#customize-amplify-generated-cognito-auth-resources), or using the `addPropertyOverride` method.

This instead removes all settings _other_ than the newly added supported provider. See the screenshots below for the comparison:

Original, before trying to override
![image](https://user-images.githubusercontent.com/30082936/220672644-66e91fde-0b7c-4d08-bf49-99066f3db6d1.png)

New, after overriding
![image](https://user-images.githubusercontent.com/30082936/220672731-0482a27b-26d5-47ec-8ebd-283d6149ecd5.png)

### Reproduction steps

1. Create a new barebones React app
2. `amplify add auth`, add a provider such as google
3. `amplify push`
4. `amplify override auth`
5. Modify the override.ts file to match the file in the bug and create a new SAML resource
6. Try to override the `supportedIdentityProviders` field on either `userPoolClient` or `userPoolClientWeb`
7. Check the client in the Cognito console and notice that Hosted UI no longer works or has any of the default settings

### Project Identifier

_No response_

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

### Before submitting, please confirm:

- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Start with the override.ts reproduction and inspect how the existing userPoolClient and userPoolClientWeb resources are represented during an Amplify auth override. Reproduce the Cognito Hosted UI regression, then verify that adding the Azure provider preserves the other client settings and supported providers.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.