aws-amplify / aws-amplify/amplify-cli

amplify override auth doesn't work as expected when updating user pool clients

Open
#9,885 4 comments 2 reactions 0 assignees View on GitHub
auth bug ops-auth p2 strategic
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Before opening, please confirm:

- [X] I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-cli/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

v14.16.1

### Amplify CLI Version

7.6.22

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

no manual changes made

### Amplify Categories

auth

### Amplify Commands

override

### Describe the bug

When adding the auth category, in case of social identity provider integration, CLI creates the Lambda custom resource to deploy the changes on user pool clients. When we try to override the user pool client changes using the command amplify override auth it will delete the configurations created by Lambda custom resource on client and cause the issue. Further at later point when the auth category is updated using the amplify update auth, it would override the changes created from the override.ts.
This causes issues as Cx cannot override the changes to the user pool client resources generated by Amplify CLI.

### Expected behavior

On Override, only the supported identity provider list should be overridden and should not delete any existing configuration. Instead amplify-cli deletes the other settings such as callback url and sign-out url which were initially added when creating the user pool via Amplify CLI. This puts the user pool in an non working state where the application starts crashing.

### Reproduction steps

1. Add the auth category to the application with Social Identity provider.
2. Provide the details about the callback URLs and signout URL accordingly.
3. Push the changes to create the auth resource
4. Override the resource using amplify override auth. And try modifying either of the app client or web app client using override.ts. eg:
```
import { AmplifyAuthCognitoStackTemplate } from '@aws-amplify/cli-extensibility-helper';

export function override(resources: AmplifyAuthCognitoStackTemplate) {
resources.userPoolClientWeb.supportedIdentityProviders = ["Auth0-SAML"]
}
```
5. Push the changes again. This would delete the callback URL and other OAuth related resource created with Amplify CLI in 2nd step above.
6. Try adding the callback URL again by executing amplify update auth. When pushed, this will delete the changes performed from override.ts.

### GraphQL schema(s)

```graphql
# Put schemas below this line

```

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the amplify override auth flow and the override.ts example, focusing on userPoolClientWeb and the Lambda custom resource used for social identity providers. Reproduce the issue by pushing an override, then running amplify update auth. Done means supportedIdentityProviders can be changed without removing callback or sign-out URLs, and later auth updates do not remove the override changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.