Open SajithTS opened 1 month ago
hello @SajithTS. Sorry to hear you are experiencing issues with the library. I'd like to get some context, could you elaborate on the following questions bellow.
How did you configure SSO for App1
and App2
?
Can you confirm if the flow bellow is accurate?
click signInWithRedirect
App1 -> redirect to App1
-> finish authenticating -> redirect to App 2
-> log out
are you able to call getCurrentUser
API on App2
?
are the attached code snippets above for App1
?
how is signOut not working? are you still able to see auth tokens ?
Hello @israx
How did you configure SSO for App1 and App2?
Configured the SSO by using same userPoolId, userPoolClientId, cognitoAuthDomain and
same Application domain
Can you confirm if the flow bellow is accurate? click signInWithRedirect App1 -> redirect to App1 -> finish authenticating -> redirect to App 2 -> log out
Yes. The flow is correct
are you able to call getCurrentUser API on App2?
Yes. getCurrentUser is working as expected
are the attached code snippets above for App1?
Yes. Same code is using in the App2 as well (Except "signInWithRedirect() API")
how is signOut not working? are you still able to see auth tokens ?
When I click the signout button, stay in the present page. Not redirecting to the login/landing page.
But auth details including tokens are cleared from the cookie.
Then if I refresh the page, it will redirect to landing page. Then clicking the login button,
take me to the App1 home page without asking the credentials
NOTE: SSO and the logout functionalities were working fine with the Amplify 5.2.4 version. After the Amplify 6 upgrade, facing this issue
@israx I can see that a parameter has been added to the local storage of App1. The key name is
CognitoIdentityServiceProvider.CLIENT_ID.oauthSignIn
The value for the above parameter is
true,false
But this Key-value is not present in the local storage of App2.
Hey @SajithTS. Before calling the signOut
API on APP2
, make a call to Amplify.getConfig
and see if you have a valid oauth
configuration.
The library will validate this oauth
config and will call the oauth
endpoint that redirects back to the app. If there is not a valid oauth config, you might need to call Amplify.configure
on App2
.
Hello @israx . I am calling Amplify.configure
in the main.ts
file of both App1 & App2.
To make sure the configuration is correct, i have printed the configuration value while calling the logout function.
The logout function definition used in the App2 and App1 is given below:
onLogoutClick() {
let a = Amplify.getConfig();
console.log('Amplify config >> ', a)
signOut({ global: true })
.then(data => console.log(data))
.catch(err => {
console.log(err)
signOut();
});
}
The console output for the above code snippet is given here:
{
"Cognito": {
"loginWith": {
"oauth": {
"domain": "COGNITO_DOMAIN",
"redirectSignIn": [
"https://app1.dev.mydomain.com/app/home"
],
"redirectSignOut": [
"https://app1.dev.mydomain.com/login"
],
"responseType": "code",
"scopes": [
"phone",
"email",
"openid",
"profile",
"aws.cognito.signin.user.admin"
]
}
},
"signUpVerificationMethod": "code",
"userPoolClientId": "CLIENT_ID",
"userPoolId": "POOL_ID"
}
}
The output is same from both App1 & App2.
hello @SajithTS. Your comment led me to determine the root cause of the issue.
The oauthSignIn
key is used to determine if a user logged in via an oauth flow. This key is only stored on localStorage
. So the moment App2 logs out, it doesn't have access to it.
I'll mark this issue as a bug. In the meantime, a heuristic workaround is to manually set the oauthSignIn
key on the localStorage
of App2.
Hey @israx . With reference to your previous comment, I have manually set the oauthSignIn
in the local storage of the App2.
The code for setting the localStorage
value is written in the layout class (This class is accessible only for the authenticated users).
Here is the code:
localStorage.setItem(`CognitoIdentityServiceProvider.${environment.cognitoAppClientId}.oauthSignIn`,`true,false`);
Value is successfully stored in localStorage of App2 and now the localStorage of App1 & App2 are identical.
Result: If I try to logout from the App2, the following error is thrown and there is no redirection to the login page. Stay in the present page.
InvalidOriginException: redirect is coming from a different origin.
The oauth flow needs to be initiated from the same origin
at 38908 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:162389:32)
at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
at 15199 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:168598:79)
at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
at 53205 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:165710:68)
at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
at 44920 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:163521:86)
at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
at 32651 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:164042:92)
at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
I see you have the following domains https://app1.dev.mydomain.com/app/home
and
https://app2.dev.mydomain.com/app/home
. And you want to logout from domain2 and redirect to domain1. So this flow is not supported at the moment. However, we have a beta version that is being worked on and that you can use to overwrite the actual redirectSignOut
from your oauth config.
You should be able to do it via the options of the signOut
API.
@israx . Thank you for your prompt response and assistance. I will keep you updated on the results once I have completed the testing.
Hey @israx. Thank you for releasing the beta version. I have tested it in my project, and it is working fine. Could you please let me know when you anticipate releasing a stable version of this beta?
Note: Currently i'm manually setting the oauthSignIn
(comment)
Do we plan on setting this key into local storage
from Amplify library itself while initialising the application, so that users don't have to set it manually every time. Because this was not an issue in Amplify v5.
Hello @SajithTS. We are looking into this issue, will follow up with any updates
Before opening, please confirm:
JavaScript Framework
Angular
Amplify APIs
Authentication, Storage
Amplify Version
v6
Amplify Categories
auth, storage
Backend
Other
Environment information
Describe the bug
I am using Angular version 17.3.12 and Amplify v6.4.2. Using hosted UI as login method. We are make use of the Single sign on since we have multiple angular applications. Also, using Cookie storage as the storage mechanism for the amplify library.
The scenario is, [Consider I have 2 applications named App1 & App2]
Expected behavior
While using Single sign on with my applications having same domain, expected to completely logout from all the linked applications seamlessly.
Reproduction steps
Code Snippet
Log output
aws-exports.js
Manual configuration
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response