fix(cognito): custom attributes in userpoolidentityprovider appear without the prefix (custom:)

packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-idp.amazon.js.snapshot/integ-user-pool-idp-amazon.template.json

@@ -75,7 +75,7 @@
     "AttributeMapping": {
      "given_name": "name",
      "email": "email",
-     "userId": "user_id"
+     "custom:userId": "user_id"
     },
     "ProviderDetails": {
      "client_id": "amzn-client-id",

packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-idp.google.js.snapshot/integ-user-pool-idp-google.template.json

@@ -90,7 +90,7 @@
      "email": "email",
      "email_verified": "email_verified",
      "gender": "gender",
-     "names": "names"
+     "custom:names": "names"
     },
     "ProviderDetails": {
      "client_id": "google-client-id",

packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-idp.saml.js.snapshot/integ-user-pool-identity-provider-saml-stack.template.json

@@ -72,6 +72,9 @@
   "samlProvider6C4CC492": {
    "Type": "AWS::Cognito::UserPoolIdentityProvider",
    "Properties": {
+    "AttributeMapping": {
+     "custom:department": "department"
+    },
     "ProviderDetails": {
      "IDPSignout": false,
      "MetadataURL": "https://fujifish.github.io/samling/public/metadata.xml",

packages/@aws-cdk-testing/framework-integ/test/aws-cognito/test/integ.user-pool-idp.saml.ts

@@ -1,7 +1,7 @@
 import { App, CfnOutput, RemovalPolicy, Stack } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { Construct } from 'constructs';
-import { UserPoolClientIdentityProvider, UserPool, UserPoolIdentityProviderSaml, UserPoolIdentityProviderSamlMetadata, SigningAlgorithm } from 'aws-cdk-lib/aws-cognito';
+import { UserPoolClientIdentityProvider, UserPool, UserPoolIdentityProviderSaml, UserPoolIdentityProviderSamlMetadata, SigningAlgorithm, ProviderAttribute } from 'aws-cdk-lib/aws-cognito';
 
 class TestStack extends Stack {
   constructor(scope: Construct, id: string) {
@@ -17,6 +17,11 @@ class TestStack extends Stack {
       metadata: UserPoolIdentityProviderSamlMetadata.url('https://fujifish.github.io/samling/public/metadata.xml'),
       encryptedResponses: true,
       requestSigningAlgorithm: SigningAlgorithm.RSA_SHA256,
+      attributeMapping: {
+        custom: {
+          department: ProviderAttribute.other('department'),
+        },
+      },
     });
 
     const client = userpool.addClient('client');

packages/@aws-cdk/aws-cognito-identitypool-alpha/test/integ.identitypool.js.snapshot/integ-identitypool.template.json

@@ -68,7 +68,7 @@
      "family_name": "family_name",
      "email": "email",
      "gender": "gender",
-     "names": "names"
+     "custom:names": "names"
     },
     "ProviderDetails": {
      "client_id": "google-client-id",
@@ -148,7 +148,7 @@
     "AttributeMapping": {
      "given_name": "name",
      "email": "email",
-     "userId": "user_id"
+     "custom:userId": "user_id"
     },
     "ProviderDetails": {
      "client_id": "amzn-client-id",

packages/aws-cdk-lib/aws-cognito/lib/user-pool-idps/private/user-pool-idp-base.ts

@@ -30,7 +30,8 @@ export abstract class UserPoolIdentityProviderBase extends Resource implements I
       }, mapping);
     if (this.props.attributeMapping.custom) {
       mapping = Object.entries(this.props.attributeMapping.custom).reduce((agg, [k, v]) => {
-        return { ...agg, [k]: v.attributeName };
+        let customAttributeKey = k.toLowerCase().startsWith('custom:') ? k : `custom:${k}`;
+        return { ...agg, [customAttributeKey]: v.attributeName };
       }, mapping);
     }
     if (Object.keys(mapping).length === 0) { return undefined; }

packages/aws-cdk-lib/aws-cognito/test/user-pool-idps/amazon.test.ts

@@ -81,19 +81,19 @@ describe('UserPoolIdentityProvider', () => {
           givenName: ProviderAttribute.AMAZON_NAME,
           address: ProviderAttribute.other('amzn-address'),
           custom: {
-            customAttr1: ProviderAttribute.AMAZON_EMAIL,
-            customAttr2: ProviderAttribute.other('amzn-custom-attr'),
+            'custom:customAttr1': ProviderAttribute.AMAZON_EMAIL,
+            'customAttr2': ProviderAttribute.other('amzn-custom-attr'),
           },
         },
       });
 
       // THEN
       Template.fromStack(stack).hasResourceProperties('AWS::Cognito::UserPoolIdentityProvider', {
         AttributeMapping: {
-          given_name: 'name',
-          address: 'amzn-address',
-          customAttr1: 'email',
-          customAttr2: 'amzn-custom-attr',
+          'given_name': 'name',
+          'address': 'amzn-address',
+          'custom:customAttr1': 'email',
+          'custom:customAttr2': 'amzn-custom-attr',
         },
       });
     });