api-gateway: access custom cognito claim in parameterMapping of HttpAlbIntegration
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When declaring a HttpAlbIntegration with parameterMapping for a regular cognito claim, say email or sub, everything works fine. But when defining a parameterMapping for a custom attribute, where the sintaxt implies using the prefix `custom:`, it complains about being an invalid expression.
I've tried according the RestApi documentation (https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html) but no luck:
`"$context.authorizer.claims['custom:my_attr']"`
### Expected Behavior
The custom attribute should be accessible like any other.
### Current Behavior
cdk returns a BadRequest:
```
Invalid mapping expression specified: Validation Result: warnings : [], errors :
[Invalid mapping expression specified: $context.authorizer.claims.custom:my_attr]
(Service: AmazonApiGatewayV2; Status Code: 400; Error Code: BadRequestException; Request ID: d9f58770-dc40-4268-9515-ef4cc354e4d3; Proxy: null)
```
### Reproduction Steps
Create a HttpAlbIntegration for the api gateway:
```
const integration = new HttpAlbIntegration('http-alb-integration', albListener, {
method: HttpMethod.ANY,
vpcLink: vpcLinkStack.vpcLink,
parameterMapping: new ParameterMapping()
.appendHeader('x-my-attr', MappingValue.contextVariable('authorizer.claims.custom:my_attr'))
});
```
cdk will complain about the `authorizer.claims.custom:my_attr` because of the `:`.
### Possible Solution
Some alternative sintax for these cases, for instance: `authorizer.claims.[custom:my_attr]`
so `custom:my_attr` would be treated as a block.
### Additional Information/Context
_No response_
### CDK CLI Version
2.41.0 (build 6ad48a3)
### Framework Version
_No response_
### Node.js Version
v16.14.2
### OS
macOS Monterey 12.5.1
### Language
Typescript
### Language Version
3.9.7
### Other information
_No response_
Contributor guide
Research direction
Start with the HttpAlbIntegration, ParameterMapping, and MappingValue.contextVariable entry points shown in the reproduction, then reproduce the Amazon API Gateway HTTP API BadRequest with the custom:my_attr claim. Trace where authorizer claim expressions are validated or assembled. Done means a custom Cognito claim can be mapped to x-my-attr without an invalid-expression error, with coverage for the reported mapping.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100