[cognito] ALB dns name has upper case that cognito does not accept as a callback url
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
By using the `aws-elasticloadbalancingv2-actions`, I noticed that the Cognito construct wants to have the callback URL in all lower case. Because it is not the case, the callback to the loadbalancer is not reached.
### Reproduction Steps
Basically, I took it from [here](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-elasticloadbalancingv2-actions-readme.html)
```javascript
const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
vpc,
internetFacing: true,
});
const userPool = new cognito.UserPool(this, 'UserPool');
const userPoolClient = new cognito.UserPoolClient(this, 'Client', {
userPool,
// Required minimal configuration for use with an ELB
generateSecret: true,
authFlows: {
userPassword: true,
},
oAuth: {
flows: {
authorizationCodeGrant: true,
},
scopes: [cognito.OAuthScope.EMAIL],
callbackUrls: [
`https://${lb.loadBalancerDnsName}/oauth2/idpresponse`,
],
},
});
const cfnClient = userPoolClient.node.defaultChild as cognito.CfnUserPoolClient;
cfnClient.addPropertyOverride('RefreshTokenValidity', 1);
cfnClient.addPropertyOverride('SupportedIdentityProviders', ['COGNITO']);
const userPoolDomain = new cognito.UserPoolDomain(this, 'Domain', {
userPool,
cognitoDomain: {
domainPrefix: 'test-cdk-prefix',
},
});
lb.addListener('Listener', {
port: 443,
certificates: [certificate],
defaultAction: new actions.AuthenticateCognitoAction({
userPool,
userPoolClient,
userPoolDomain,
next: elbv2.ListenerAction.fixedResponse(200, {
contentType: 'text/plain',
messageBody: 'Authenticated',
}),
}),
});
new CfnOutput(this, 'DNS', {
value: lb.loadBalancerDnsName,
});
}
}
const app = new App();
new CognitoStack(app, 'integ-cognito');
app.synth();
```
### What did you expect to happen?
A redirect to the loadbalancer.
### What actually happened?
The cognito domain appends an `error`.
### Environment
- **CLI Version :** 1.70.0
- **Framework Version:** 1.70.0
- **Node.js Version:** 12.18.3
- **OS :** Ubuntu
- **Language (Version):** Python 3.8
### Other
---
This is :bug: Bug Report
Contributor guide
Research direction
Start with the aws-elasticloadbalancingv2-actions example and trace AuthenticateCognitoAction together with the callbackUrls configuration shown in the reproduction. Confirm how the ALB DNS name is passed to Cognito and reproduce the redirect failure with the provided stack. Done means the documented configuration reaches the load balancer through Cognito without the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100