Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(cognito): user pool client logout urls #10301

Merged
merged 4 commits into from
Sep 16, 2020
Merged

feat(cognito): user pool client logout urls #10301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
756fcbc
feat(cognito): Support LogoutURLs in UserPoolClient
tneely Sep 11, 2020
5f2b7fd
Include logoutUrls example in readme
tneely Sep 11, 2020
1460df2
Merge branch 'master' into master
tneely Sep 15, 2020
09230d4
Merge branch 'master' into master
mergify[bot] Sep 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/@aws-cdk/aws-cognito/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,6 +472,7 @@ pool.addClient('app-client', {
},
scopes: [ OAuthScope.OPENID ],
callbackUrls: [ 'https://my-app-domain.com/welcome' ],
logoutUrls: [ 'https://my-app-domain.com/signin' ],
}
});
```
Expand Down
7 changes: 7 additions & 0 deletions packages/@aws-cdk/aws-cognito/lib/user-pool-client.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,12 @@ export interface OAuthSettings {
*/
readonly callbackUrls?: string[];

/**
* List of allowed logout URLs for the identity providers.
* @default - no logout URLs
*/
readonly logoutUrls?: string[];
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason you've added it within OAuthSettings? AFAICT from the documentation, this isn't related to OAuth.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Callback url and Logout urls are part of the oAuth configuration.

the settings in the UI is under App client settings (title "What identity providers and OAuth 2.0 settings should be used for your app clients".

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

worth mention that CFN user pool clients is flat. but here in CDK I see a structure by oAuth.
anyhow, logoutUrls should be besides callbarckIUrls that currently inside the oAuth object.


/**
* OAuth scopes that are allowed with this client.
* @see https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-app-idp-settings.html
Expand Down Expand Up @@ -315,6 +321,7 @@ export class UserPoolClient extends Resource implements IUserPoolClient {
allowedOAuthFlows: props.disableOAuth ? undefined : this.configureOAuthFlows(),
allowedOAuthScopes: props.disableOAuth ? undefined : this.configureOAuthScopes(props.oAuth),
callbackUrLs: callbackUrls && callbackUrls.length > 0 ? callbackUrls : undefined,
logoutUrLs: props.oAuth?.logoutUrls,
allowedOAuthFlowsUserPoolClient: !props.disableOAuth,
preventUserExistenceErrors: this.configurePreventUserExistenceErrors(props.preventUserExistenceErrors),
supportedIdentityProviders: this.configureIdentityProviders(props),
Expand Down
15 changes: 15 additions & 0 deletions packages/@aws-cdk/aws-cognito/test/user-pool-client.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,21 @@ describe('User Pool Client', () => {
})).not.toThrow();
});

test('logoutUrls can be set', () => {
const stack = new Stack();
const pool = new UserPool(stack, 'Pool');

pool.addClient('Client', {
oAuth: {
logoutUrls: ['https://example.com'],
},
});

expect(stack).toHaveResourceLike('AWS::Cognito::UserPoolClient', {
LogoutURLs: ['https://example.com'],
});
});

test('fails when clientCredentials OAuth flow is selected along with codeGrant or implicitGrant', () => {
const stack = new Stack();
const pool = new UserPool(stack, 'Pool');
Expand Down