aws-cdk-lib.aws_cognito.OAuthSettings

OAuthSettings Struct

OAuth settings to configure the interaction between the app and this client.

Source

aws-cognito/lib/user-pool-client.ts

Type last changed

v2.148.0 · 5 Jul 2024

Example

const pool = new cognito.UserPool(this, 'Pool');

const readOnlyScope = new cognito.ResourceServerScope({ scopeName: 'read', scopeDescription: 'Read-only access' });
const fullAccessScope = new cognito.ResourceServerScope({ scopeName: '*', scopeDescription: 'Full access' });

const userServer = pool.addResourceServer('ResourceServer', {
  identifier: 'users',
  scopes: [ readOnlyScope, fullAccessScope ],
});

const readOnlyClient = pool.addClient('read-only-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, readOnlyScope) ],
  },
});

const fullAccessClient = pool.addClient('full-access-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, fullAccessScope) ],
  },
});

Properties

callbackUrlsstring[]callback_urlstyping.List[str]callbackUrlsList<String>CallbackUrlsstring[]CallbackUrls*[]*string= ['https://example.com'] if eithe…#

List of allowed redirect URLs for the identity providers.

default

Default: ['https://example.com'] if either authorizationCodeGrant or implicitCodeGrant flows are enabled, no callback URLs otherwise.

defaultRedirectUristringdefault_redirect_uristrdefaultRedirectUriStringDefaultRedirectUristringDefaultRedirectUri*string= no default redirect URI#

The default redirect URI. Must be in the `callbackUrls` list.

A redirect URI must:

• Be an absolute URI
• Be registered with the authorization server.
• Not include a fragment component.

flowsOAuthFlowsflowsOAuthFlowsflowsOAuthFlowsFlowsOAuthFlowsFlowsOAuthFlows= {authorizationCodeGrant:true,imp…#

OAuth flows that are allowed with this client.

default

Default: {authorizationCodeGrant:true,implicitCodeGrant:true}

logoutUrlsstring[]logout_urlstyping.List[str]logoutUrlsList<String>LogoutUrlsstring[]LogoutUrls*[]*string= no logout URLs#

List of allowed logout URLs for the identity providers.

scopesOAuthScope[]scopestyping.List[OAuthScope]scopesList<OAuthScope>ScopesOAuthScope[]Scopes*[]OAuthScope= [OAuthScope.PHONE,OAuthScope.EMA…#

OAuth scopes that are allowed with this client.

default

Default: [OAuthScope.PHONE,OAuthScope.EMAIL,OAuthScope.OPENID,OAuthScope.PROFILE,OAuthScope.COGNITO_ADMIN]