-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into s3-object-size-less-than
- Loading branch information
Showing
69 changed files
with
2,042 additions
and
383 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
157 changes: 157 additions & 0 deletions
157
packages/@aws-cdk/aws-cognito/lib/user-pool-idps/oidc.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| import { Names, Token } from '@aws-cdk/core'; | ||
| import { Construct } from 'constructs'; | ||
| import { CfnUserPoolIdentityProvider } from '../cognito.generated'; | ||
| import { UserPoolIdentityProviderProps } from './base'; | ||
| import { UserPoolIdentityProviderBase } from './private/user-pool-idp-base'; | ||
|
|
||
| /** | ||
| * Properties to initialize UserPoolIdentityProviderOidc | ||
| */ | ||
| export interface UserPoolIdentityProviderOidcProps extends UserPoolIdentityProviderProps { | ||
| /** | ||
| * The client id | ||
| */ | ||
| readonly clientId: string; | ||
|
|
||
| /** | ||
| * The client secret | ||
| */ | ||
| readonly clientSecret: string; | ||
|
|
||
| /** | ||
| * Issuer URL | ||
| */ | ||
| readonly issuerUrl: string; | ||
|
|
||
| /** | ||
| * The name of the provider | ||
| * | ||
| * @default - the unique ID of the construct | ||
| */ | ||
| readonly name?: string; | ||
|
|
||
| /** | ||
| * The OAuth 2.0 scopes that you will request from OpenID Connect. Scopes are | ||
| * groups of OpenID Connect user attributes to exchange with your app. | ||
| * | ||
| * @default ['openid'] | ||
| */ | ||
| readonly scopes?: string[]; | ||
|
|
||
| /** | ||
| * Identifiers | ||
| * | ||
| * Identifiers can be used to redirect users to the correct IdP in multitenant apps. | ||
| * | ||
| * @default - no identifiers used | ||
| */ | ||
| readonly identifiers?: string[] | ||
|
|
||
| /** | ||
| * The method to use to request attributes | ||
| * | ||
| * @default OidcAttributeRequestMethod.GET | ||
| */ | ||
| readonly attributeRequestMethod?: OidcAttributeRequestMethod | ||
|
|
||
| /** | ||
| * OpenID connect endpoints | ||
| * | ||
| * @default - auto discovered with issuer URL | ||
| */ | ||
| readonly endpoints?: OidcEndpoints; | ||
| } | ||
|
|
||
| /** | ||
| * OpenID Connect endpoints | ||
| */ | ||
| export interface OidcEndpoints { | ||
| /** | ||
| * Authorization endpoint | ||
| */ | ||
| readonly authorization: string; | ||
|
|
||
| /** | ||
| * Token endpoint | ||
| */ | ||
| readonly token: string; | ||
|
|
||
| /** | ||
| * UserInfo endpoint | ||
| */ | ||
| readonly userInfo: string; | ||
|
|
||
| /** | ||
| * Jwks_uri endpoint | ||
| */ | ||
| readonly jwksUri: string; | ||
| } | ||
|
|
||
| /** | ||
| * The method to use to request attributes | ||
| */ | ||
| export enum OidcAttributeRequestMethod { | ||
| /** GET */ | ||
| GET = 'GET', | ||
| /** POST */ | ||
| POST = 'POST' | ||
| } | ||
|
|
||
| /** | ||
| * Represents a identity provider that integrates with OpenID Connect | ||
| * @resource AWS::Cognito::UserPoolIdentityProvider | ||
| */ | ||
| export class UserPoolIdentityProviderOidc extends UserPoolIdentityProviderBase { | ||
| public readonly providerName: string; | ||
|
|
||
| constructor(scope: Construct, id: string, props: UserPoolIdentityProviderOidcProps) { | ||
| super(scope, id, props); | ||
|
|
||
| if (props.name && !Token.isUnresolved(props.name) && (props.name.length < 3 || props.name.length > 32)) { | ||
| throw new Error(`Expected provider name to be between 3 and 32 characters, received ${props.name} (${props.name.length} characters)`); | ||
| } | ||
|
|
||
| const scopes = props.scopes ?? ['openid']; | ||
|
|
||
| const resource = new CfnUserPoolIdentityProvider(this, 'Resource', { | ||
| userPoolId: props.userPool.userPoolId, | ||
| providerName: this.getProviderName(props.name), | ||
| providerType: 'OIDC', | ||
| providerDetails: { | ||
| client_id: props.clientId, | ||
| client_secret: props.clientSecret, | ||
| authorize_scopes: scopes.join(' '), | ||
| attributes_request_method: props.attributeRequestMethod ?? OidcAttributeRequestMethod.GET, | ||
| oidc_issuer: props.issuerUrl, | ||
| authorize_url: props.endpoints?.authorization, | ||
| token_url: props.endpoints?.token, | ||
| attributes_url: props.endpoints?.userInfo, | ||
| jwks_uri: props.endpoints?.jwksUri, | ||
| }, | ||
| idpIdentifiers: props.identifiers, | ||
| attributeMapping: super.configureAttributeMapping(), | ||
| }); | ||
|
|
||
| this.providerName = super.getResourceNameAttribute(resource.ref); | ||
| } | ||
|
|
||
| private getProviderName(name?: string): string { | ||
| if (name) { | ||
| if (!Token.isUnresolved(name) && (name.length < 3 || name.length > 32)) { | ||
| throw new Error(`Expected provider name to be between 3 and 32 characters, received ${name} (${name.length} characters)`); | ||
| } | ||
| return name; | ||
| } | ||
|
|
||
| const uniqueId = Names.uniqueId(this); | ||
|
|
||
| if (uniqueId.length < 3) { | ||
| return `${uniqueId}oidc`; | ||
| } | ||
|
|
||
| if (uniqueId.length > 32) { | ||
| return uniqueId.substring(0, 16) + uniqueId.substring(uniqueId.length - 16); | ||
| } | ||
| return uniqueId; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
45 changes: 45 additions & 0 deletions
45
packages/@aws-cdk/aws-cognito/test/integ.user-pool-idp.oidc.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| import { App, CfnOutput, RemovalPolicy, Stack } from '@aws-cdk/core'; | ||
| import { ProviderAttribute, UserPool, UserPoolIdentityProviderOidc } from '../lib'; | ||
|
|
||
| /* | ||
| * Stack verification steps | ||
| * * Visit the URL provided by stack output 'SignInLink' in a browser, and verify the 'cdk' sign in link shows up. | ||
| */ | ||
| const app = new App(); | ||
| const stack = new Stack(app, 'integ-user-pool-idp-google'); | ||
|
|
||
| const userpool = new UserPool(stack, 'pool', { | ||
| removalPolicy: RemovalPolicy.DESTROY, | ||
| }); | ||
|
|
||
| new UserPoolIdentityProviderOidc(stack, 'cdk', { | ||
| userPool: userpool, | ||
| name: 'cdk', | ||
| clientId: 'client-id', | ||
| clientSecret: 'client-secret', | ||
| issuerUrl: 'https://www.issuer-url.com', | ||
| endpoints: { | ||
| authorization: 'https://www.issuer-url.com/authorize', | ||
| token: 'https://www.issuer-url.com/token', | ||
| userInfo: 'https://www.issuer-url.com/userinfo', | ||
| jwksUri: 'https://www.issuer-url.com/jwks', | ||
| }, | ||
| scopes: ['openid', 'phone'], | ||
| attributeMapping: { | ||
| phoneNumber: ProviderAttribute.other('phone_number'), | ||
| }, | ||
| }); | ||
|
|
||
| const client = userpool.addClient('client'); | ||
|
|
||
| const domain = userpool.addDomain('domain', { | ||
| cognitoDomain: { | ||
| domainPrefix: 'cdk-test-pool', | ||
| }, | ||
| }); | ||
|
|
||
| new CfnOutput(stack, 'SignInLink', { | ||
| value: domain.signInUrl(client, { | ||
| redirectUri: 'https://example.com', | ||
| }), | ||
| }); |
1 change: 1 addition & 0 deletions
1
packages/@aws-cdk/aws-cognito/test/user-pool-idp.oidc.integ.snapshot/cdk.out
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {"version":"18.0.0"} |
121 changes: 121 additions & 0 deletions
121
...s-cognito/test/user-pool-idp.oidc.integ.snapshot/integ-user-pool-idp-google.template.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,121 @@ | ||
| { | ||
| "Resources": { | ||
| "pool056F3F7E": { | ||
| "Type": "AWS::Cognito::UserPool", | ||
| "Properties": { | ||
| "AccountRecoverySetting": { | ||
| "RecoveryMechanisms": [ | ||
| { | ||
| "Name": "verified_phone_number", | ||
| "Priority": 1 | ||
| }, | ||
| { | ||
| "Name": "verified_email", | ||
| "Priority": 2 | ||
| } | ||
| ] | ||
| }, | ||
| "AdminCreateUserConfig": { | ||
| "AllowAdminCreateUserOnly": true | ||
| }, | ||
| "EmailVerificationMessage": "The verification code to your new account is {####}", | ||
| "EmailVerificationSubject": "Verify your new account", | ||
| "SmsVerificationMessage": "The verification code to your new account is {####}", | ||
| "VerificationMessageTemplate": { | ||
| "DefaultEmailOption": "CONFIRM_WITH_CODE", | ||
| "EmailMessage": "The verification code to your new account is {####}", | ||
| "EmailSubject": "Verify your new account", | ||
| "SmsMessage": "The verification code to your new account is {####}" | ||
| } | ||
| }, | ||
| "UpdateReplacePolicy": "Delete", | ||
| "DeletionPolicy": "Delete" | ||
| }, | ||
| "poolclient2623294C": { | ||
| "Type": "AWS::Cognito::UserPoolClient", | ||
| "Properties": { | ||
| "UserPoolId": { | ||
| "Ref": "pool056F3F7E" | ||
| }, | ||
| "AllowedOAuthFlows": [ | ||
| "implicit", | ||
| "code" | ||
| ], | ||
| "AllowedOAuthFlowsUserPoolClient": true, | ||
| "AllowedOAuthScopes": [ | ||
| "profile", | ||
| "phone", | ||
| "email", | ||
| "openid", | ||
| "aws.cognito.signin.user.admin" | ||
| ], | ||
| "CallbackURLs": [ | ||
| "https://example.com" | ||
| ], | ||
| "SupportedIdentityProviders": [ | ||
| { | ||
| "Ref": "cdk52888317" | ||
| }, | ||
| "COGNITO" | ||
| ] | ||
| } | ||
| }, | ||
| "pooldomain430FA744": { | ||
| "Type": "AWS::Cognito::UserPoolDomain", | ||
| "Properties": { | ||
| "Domain": "cdk-test-pool", | ||
| "UserPoolId": { | ||
| "Ref": "pool056F3F7E" | ||
| } | ||
| } | ||
| }, | ||
| "cdk52888317": { | ||
| "Type": "AWS::Cognito::UserPoolIdentityProvider", | ||
| "Properties": { | ||
| "ProviderName": "cdk", | ||
| "ProviderType": "OIDC", | ||
| "UserPoolId": { | ||
| "Ref": "pool056F3F7E" | ||
| }, | ||
| "AttributeMapping": { | ||
| "phone_number": "phone_number" | ||
| }, | ||
| "ProviderDetails": { | ||
| "client_id": "client-id", | ||
| "client_secret": "client-secret", | ||
| "authorize_scopes": "openid phone", | ||
| "attributes_request_method": "GET", | ||
| "oidc_issuer": "https://www.issuer-url.com", | ||
| "authorize_url": "https://www.issuer-url.com/authorize", | ||
| "token_url": "https://www.issuer-url.com/token", | ||
| "attributes_url": "https://www.issuer-url.com/userinfo", | ||
| "jwks_uri": "https://www.issuer-url.com/jwks" | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "Outputs": { | ||
| "SignInLink": { | ||
| "Value": { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "https://", | ||
| { | ||
| "Ref": "pooldomain430FA744" | ||
| }, | ||
| ".auth.", | ||
| { | ||
| "Ref": "AWS::Region" | ||
| }, | ||
| ".amazoncognito.com/login?client_id=", | ||
| { | ||
| "Ref": "poolclient2623294C" | ||
| }, | ||
| "&response_type=code&redirect_uri=https://example.com" | ||
| ] | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.