aws-amplify / aws-amplify/amplify-cli
amplify init in headless mode after amplify import auth, I get error "OAuth properties for the app clients are not matching".
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### Before opening, please confirm:
- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
14.x
### Amplify CLI Version
5.2.0
### What operating system are you using?
Ubuntu
### Amplify Categories
auth
### Amplify Commands
init
### Describe the bug
When I ran the `amplify init` in headless mode with the imported cognito, I got the error `OAuth properties for the app clients are not matching.`
When I read the code of the amplify CLI for confirmation, I found out that it checks if the properties match for two appClient, appClientWeb and appClientNative.
In addition, in the checking process (appClientAustPropertiesMatching), it was even checking if the callback URL and logout URL that can be set for each app client matched.
This seems like overkill.
I would like to specify different callback URLs and logout URLs for the web application and the native app respectively.
For example, we can do the following
For the web
URL for callback: https://example.com/signInCallback
URL for logout: https://example.com
For native apps
URL for callback: myapp://signInCallback
URL for logout: myapp://home
As you can see, the URL scheme itself is different between the web and native applications, and it depends on the implementation what kind of URLs are handled.
In order to pass the aforementioned property check, set "https://example.com/signInCallback, myapp://signInCallback" as the callback URL in Cognito's "App Client Settings" and For the logout URL, you need to specify "https://example.com, myapp://home".
We think this is unnatural, and we would like to improve it.
### Expected behavior
Amplify init succeeds even if the callback URL and logout URL of appclientWeb and appClientNative do not match.
### Reproduction steps
1. Import an existing cognito with `amplify import auth`.
2. create two cognito app clients. (One for web and the other for native).
3. go to "App Client Settings" and enter different URLs for web and native app clients in Callback URL and Logout URL respectively.
4. Run the amplify init in headless mode.
```bash
AMPLIFY="{\"envName\":\"xxx\"}"
AUTHCONFIG="{\"userPoolId\":\"xxxxx\",\"webClientId\":\"xxxxx\",\"nativeClientId\":\"xxxxx\",\"identityPoolId\":\"xxxxx\"}"
CATEGORIES="{\"auth\":$AUTHCONFIG}"
amplify init --amplify $AMPLIFY --categories $CATEGORIES --yes
```
### GraphQL schema(s)
_No response_
### Log output
```
# Put your logs below this line
Using default provider awscloudformation
- Initializing your environment: dev
✔ Initialized provider successfully.
✖ There was an error initializing your environment.
Error: OAuth properties for the app clients are not matching.
at Object.headlessImport (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts:1203:11)
at processTicksAndRejections (internal/process/task_queues.js:95:5)
at importedAuthEnvInit (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts:921:12)
at updateConfigOnEnvInit (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/index.js:50:72)
at /home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/index.js:306:22
Error: Process completed with exit code 1.
```
### Additional information
_No response_
Contributor guide
Research direction
Start at amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts, in headlessImport around the reported line 1203, and trace the OAuth property comparison used during imported auth initialization. Reproduce the issue with the documented amplify import auth and headless amplify init commands. Done means initialization succeeds when the web and native app clients use different callback and logout URLs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100