feat(cognito): user pool client logout urls

[tneely]

Support Logout URLs in UserPoolClient.

This is a pretty minimal change to just allow the property to be set.

fixes: #10225

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[lielran]

Great stuff! Thanks @tneely

[nija-at]

Any reason you've added it within OAuthSettings? AFAICT from the documentation, this isn't related to OAuth.

[lielran]

Callback url and Logout urls are part of the oAuth configuration.

the settings in the UI is under App client settings (title "What identity providers and OAuth 2.0 settings should be used for your app clients".

[lielran]

worth mention that CFN user pool clients is flat. but here in CDK I see a structure by oAuth.
anyhow, logoutUrls should be besides callbarckIUrls that currently inside the oAuth object.

[nija-at]

I can make this more inline with the callbackUrls behavior, but I'm
not sure what the intent is behind that logic. Is it needed for the CFn
template to deploy correctly, or are we trying to nudge users towards
using the property because without it you won't be able to sign in/out
properly?

I don't recall which one it was, in this case, but likely so that the template
deploys correctly. In general, in the CDK, we try our best to do both - let
users produce a correct template and guide them towards the correct use
of properties so that the Cognito app is set up correctly.

Could you deploy a cdk app with this value set and report back?

[tneely]

I tried deploying the following resource with and without CallbackURLs and LogoutURLs. The template deploys just fine without LogoutURLs, but gives the following error when CallbackURLs is missing: CallbackUrls can not be empty when code flow or implicit flow is selected

"AuthenticationUserPoolUserPoolClient8AE1704E": {
      "Type": "AWS::Cognito::UserPoolClient",
      "Properties": {
        "UserPoolId": {
          "Ref": "AuthenticationUserPool28698864"
        },
        "AllowedOAuthFlows": ["implicit", "code"],
        "AllowedOAuthFlowsUserPoolClient": true,
        "AllowedOAuthScopes": [
          "profile",
          "phone",
          "email",
          "openid",
          "aws.cognito.signin.user.admin"
        ],
        "CallbackURLs": ["https://www.example.com"],
        "LogoutURLs": ["https://www.example.com"],
        "SupportedIdentityProviders": ["COGNITO"]
      }
    }
  }

Pull request has been modified.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 09230d4
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).