aws / aws/aws-cdk

api-gateway: access custom cognito claim in parameterMapping of HttpAlbIntegration

Open
#22,010 9 comments 12 reactions 0 assignees View on GitHub
@aws-cdk/aws-apigateway bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When declaring a HttpAlbIntegration with parameterMapping for a regular cognito claim, say email or sub, everything works fine. But when defining a parameterMapping for a custom attribute, where the sintaxt implies using the prefix `custom:`, it complains about being an invalid expression.

I've tried according the RestApi documentation (https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html) but no luck:
`"$context.authorizer.claims['custom:my_attr']"`

### Expected Behavior

The custom attribute should be accessible like any other.

### Current Behavior

cdk returns a BadRequest:
```
Invalid mapping expression specified: Validation Result: warnings : [], errors :
[Invalid mapping expression specified: $context.authorizer.claims.custom:my_attr]
(Service: AmazonApiGatewayV2; Status Code: 400; Error Code: BadRequestException; Request ID: d9f58770-dc40-4268-9515-ef4cc354e4d3; Proxy: null)
```

### Reproduction Steps

Create a HttpAlbIntegration for the api gateway:
```
const integration = new HttpAlbIntegration('http-alb-integration', albListener, {
method: HttpMethod.ANY,
vpcLink: vpcLinkStack.vpcLink,
parameterMapping: new ParameterMapping()
.appendHeader('x-my-attr', MappingValue.contextVariable('authorizer.claims.custom:my_attr'))
});
```

cdk will complain about the `authorizer.claims.custom:my_attr` because of the `:`.

### Possible Solution

Some alternative sintax for these cases, for instance: `authorizer.claims.[custom:my_attr]`
so `custom:my_attr` would be treated as a block.

### Additional Information/Context

_No response_

### CDK CLI Version

2.41.0 (build 6ad48a3)

### Framework Version

_No response_

### Node.js Version

v16.14.2

### OS

macOS Monterey 12.5.1

### Language

Typescript

### Language Version

3.9.7

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the HttpAlbIntegration, ParameterMapping, and MappingValue.contextVariable entry points shown in the reproduction, then reproduce the Amazon API Gateway HTTP API BadRequest with the custom:my_attr claim. Trace where authorizer claim expressions are validated or assembled. Done means a custom Cognito claim can be mapped to x-my-attr without an invalid-expression error, with coverage for the reported mapping.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.