aws-samples / aws-samples/aws-saas-factory-ref-solution-serverless-saas

custom:tenantId and custom:tenantTier not passed to new user

Open
#95 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
522
Forks
168
Avg merge
7d 8h
Merged PRs (30d)
1

Description

Assume I am a TenantAdmin signed-in in the Application App, and I create a new user in BASIC tier within the App, the Cognito attributes: custom:tenantId and custom:tenantTier are not set within the new user.

Later, if I login with the newly created user in the Application App, the products and orders cannot be retrieved. The ApiGatewayAuthorizer breaks as the custom:tenantId is not set in the user's parameters.

I suppose there is a bug in the user-management api? In my opinion it should be set in

server/src/layers/cognito/user_management_util.py

from this...
```python
def create_user(user_pool_id, user_details):
response = cognito.admin_create_user(
Username=user_details['userName'],
UserPoolId=user_pool_id,
ForceAliasCreation=True,
UserAttributes=
[
{
'Name': 'email',
'Value': user_details['userEmail']
},
{
'Name': 'email_verified',
'Value': 'true'
},
{
'Name': 'custom:userRole',
'Value': user_details['userRole']
}
]
)
return response
```

to this...
```python
def create_user(user_pool_id, user_details):
response = cognito.admin_create_user(
Username=user_details['userName'],
UserPoolId=user_pool_id,
ForceAliasCreation=True,
UserAttributes=
[
{
'Name': 'email',
'Value': user_details['userEmail']
},
{
'Name': 'email_verified',
'Value': 'true'
},
{
'Name': 'custom:userRole',
'Value': user_details['userRole']
},
{
'Name': 'custom:tenantId',
'Value': user_details['tenantId']
}
]
)
return response
```

Do you agree?

Contributor guide

Open the contributing guide

Research direction

Start in server/src/layers/cognito/user_management_util.py at create_user, then trace how user_details supplies tenantId and tenantTier. Verify that newly created Cognito users receive the required tenant attributes and that a subsequent login can retrieve products and orders without the authorizer failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
authentication, backend-api-design
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.