aws / aws/aws-cdk

[cognito] ALB dns name has upper case that cognito does not accept as a callback url

Open
#11,171 17 comments 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-cognito @aws-cdk/aws-elasticloadbalancingv2 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

By using the `aws-elasticloadbalancingv2-actions`, I noticed that the Cognito construct wants to have the callback URL in all lower case. Because it is not the case, the callback to the loadbalancer is not reached.

### Reproduction Steps
Basically, I took it from [here](https://docs.aws.amazon.com/cdk/api/latest/docs/aws-elasticloadbalancingv2-actions-readme.html)

```javascript
const lb = new elbv2.ApplicationLoadBalancer(this, 'LB', {
vpc,
internetFacing: true,
});

const userPool = new cognito.UserPool(this, 'UserPool');
const userPoolClient = new cognito.UserPoolClient(this, 'Client', {
userPool,

// Required minimal configuration for use with an ELB
generateSecret: true,
authFlows: {
userPassword: true,
},
oAuth: {
flows: {
authorizationCodeGrant: true,
},
scopes: [cognito.OAuthScope.EMAIL],
callbackUrls: [
`https://${lb.loadBalancerDnsName}/oauth2/idpresponse`,
],
},
});
const cfnClient = userPoolClient.node.defaultChild as cognito.CfnUserPoolClient;
cfnClient.addPropertyOverride('RefreshTokenValidity', 1);
cfnClient.addPropertyOverride('SupportedIdentityProviders', ['COGNITO']);

const userPoolDomain = new cognito.UserPoolDomain(this, 'Domain', {
userPool,
cognitoDomain: {
domainPrefix: 'test-cdk-prefix',
},
});

lb.addListener('Listener', {
port: 443,
certificates: [certificate],
defaultAction: new actions.AuthenticateCognitoAction({
userPool,
userPoolClient,
userPoolDomain,
next: elbv2.ListenerAction.fixedResponse(200, {
contentType: 'text/plain',
messageBody: 'Authenticated',
}),
}),
});

new CfnOutput(this, 'DNS', {
value: lb.loadBalancerDnsName,
});
}
}

const app = new App();
new CognitoStack(app, 'integ-cognito');
app.synth();
```

### What did you expect to happen?

A redirect to the loadbalancer.

### What actually happened?

The cognito domain appends an `error`.

### Environment

- **CLI Version :** 1.70.0
- **Framework Version:** 1.70.0
- **Node.js Version:** 12.18.3
- **OS :** Ubuntu
- **Language (Version):** Python 3.8

### Other

---

This is :bug: Bug Report

Contributor guide

Open the contributing guide

Research direction

Start with the aws-elasticloadbalancingv2-actions example and trace AuthenticateCognitoAction together with the callbackUrls configuration shown in the reproduction. Confirm how the ALB DNS name is passed to Cognito and reproduce the redirect failure with the provided stack. Done means the documented configuration reaches the load balancer through Cognito without the reported error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
authentication, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.