aws-amplify / aws-amplify/amplify-cli

amplify init in headless mode after amplify import auth, I get error "OAuth properties for the app clients are not matching".

Open
#7,821 3 comments 0 reactions 0 assignees View on GitHub
auth bug p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

14.x

### Amplify CLI Version

5.2.0

### What operating system are you using?

Ubuntu

### Amplify Categories

auth

### Amplify Commands

init

### Describe the bug

When I ran the `amplify init` in headless mode with the imported cognito, I got the error `OAuth properties for the app clients are not matching.`

When I read the code of the amplify CLI for confirmation, I found out that it checks if the properties match for two appClient, appClientWeb and appClientNative.
In addition, in the checking process (appClientAustPropertiesMatching), it was even checking if the callback URL and logout URL that can be set for each app client matched.
This seems like overkill.

I would like to specify different callback URLs and logout URLs for the web application and the native app respectively.
For example, we can do the following

For the web
URL for callback: https://example.com/signInCallback
URL for logout: https://example.com

For native apps
URL for callback: myapp://signInCallback
URL for logout: myapp://home

As you can see, the URL scheme itself is different between the web and native applications, and it depends on the implementation what kind of URLs are handled.

In order to pass the aforementioned property check, set "https://example.com/signInCallback, myapp://signInCallback" as the callback URL in Cognito's "App Client Settings" and For the logout URL, you need to specify "https://example.com, myapp://home".
We think this is unnatural, and we would like to improve it.

### Expected behavior

Amplify init succeeds even if the callback URL and logout URL of appclientWeb and appClientNative do not match.

### Reproduction steps

1. Import an existing cognito with `amplify import auth`.
2. create two cognito app clients. (One for web and the other for native).
3. go to "App Client Settings" and enter different URLs for web and native app clients in Callback URL and Logout URL respectively.
4. Run the amplify init in headless mode.
```bash
AMPLIFY="{\"envName\":\"xxx\"}"
AUTHCONFIG="{\"userPoolId\":\"xxxxx\",\"webClientId\":\"xxxxx\",\"nativeClientId\":\"xxxxx\",\"identityPoolId\":\"xxxxx\"}"
CATEGORIES="{\"auth\":$AUTHCONFIG}"
amplify init --amplify $AMPLIFY --categories $CATEGORIES --yes
```

### GraphQL schema(s)

_No response_

### Log output

```
# Put your logs below this line
Using default provider awscloudformation
- Initializing your environment: dev
✔ Initialized provider successfully.
✖ There was an error initializing your environment.
Error: OAuth properties for the app clients are not matching.
at Object.headlessImport (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts:1203:11)
at processTicksAndRejections (internal/process/task_queues.js:95:5)
at importedAuthEnvInit (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts:921:12)
at updateConfigOnEnvInit (/home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/provider-utils/awscloudformation/index.js:50:72)
at /home/runner/.config/yarn/global/node_modules/amplify-category-auth/src/index.js:306:22
Error: Process completed with exit code 1.

```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at amplify-category-auth/src/provider-utils/awscloudformation/import/index.ts, in headlessImport around the reported line 1203, and trace the OAuth property comparison used during imported auth initialization. Reproduce the issue with the documented amplify import auth and headless amplify init commands. Done means initialization succeeds when the web and native app clients use different callback and logout URLs.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.