Amplify 6 logout issue with Single sign on #13638

SajithTS · 2024-07-24T12:41:20Z

Before opening, please confirm:

I have searched for duplicate or closed issues and discussions.
I have read the guide for submitting bug reports.
I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

Angular

Amplify APIs

Authentication, Storage

Amplify Version

v6

Amplify Categories

auth, storage

Backend

Other

Environment information

System:
    OS: Linux 5.15 Ubuntu 20.04.6 LTS (Focal Fossa)
    CPU: (8) x64 11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz
    Memory: 8.94 GB / 15.36 GB
    Container: Yes
    Shell: 5.0.17 - /bin/bash
  Binaries:
    Node: 20.15.1 - ~/.nvm/versions/node/v20.15.1/bin/node
    npm: 10.7.0 - ~/.nvm/versions/node/v20.15.1/bin/npm
  Browsers:
    Chrome: 126.0.6478.182
  npmPackages:
    @angular-devkit/build-angular: ^17.3.8 => 17.3.8 
    @angular/animations: ^17.3.11 => 17.3.12 
    @angular/cdk: ^17.3.10 => 17.3.10 
    @angular/cli: ~17.3.8 => 17.3.8 
    @angular/common: ^17.3.11 => 17.3.12 
    @angular/compiler: ^17.3.11 => 17.3.12 
    @angular/compiler-cli: ^17.3.11 => 17.3.12 
    @angular/core: ^17.3.11 => 17.3.12 
    @angular/forms: ^17.3.11 => 17.3.12 
    @angular/material: ^17.3.10 => 17.3.10 
    @angular/platform-browser: ^17.3.11 => 17.3.12 
    @angular/platform-browser-dynamic: ^17.3.11 => 17.3.12 
    @angular/router: ^17.3.11 => 17.3.12 
    @types/google.maps: ^3.51.0 => 3.55.11 
    @types/jasmine: ~4.3.0 => 4.3.6 
    aws-amplify: ^6.4.2 => 6.4.3 
    aws-amplify/adapter-core:  undefined ()
    aws-amplify/analytics:  undefined ()
    aws-amplify/analytics/kinesis:  undefined ()
    aws-amplify/analytics/kinesis-firehose:  undefined ()
    aws-amplify/analytics/personalize:  undefined ()
    aws-amplify/analytics/pinpoint:  undefined ()
    aws-amplify/api:  undefined ()
    aws-amplify/api/server:  undefined ()
    aws-amplify/auth:  undefined ()
    aws-amplify/auth/cognito:  undefined ()
    aws-amplify/auth/cognito/server:  undefined ()
    aws-amplify/auth/enable-oauth-listener:  undefined ()
    aws-amplify/auth/server:  undefined ()
    aws-amplify/data:  undefined ()
    aws-amplify/data/server:  undefined ()
    aws-amplify/datastore:  undefined ()
    aws-amplify/in-app-messaging:  undefined ()
    aws-amplify/in-app-messaging/pinpoint:  undefined ()
    aws-amplify/push-notifications:  undefined ()
    aws-amplify/push-notifications/pinpoint:  undefined ()
    aws-amplify/storage:  undefined ()
    aws-amplify/storage/s3:  undefined ()
    aws-amplify/storage/s3/server:  undefined ()
    aws-amplify/storage/server:  undefined ()
    aws-amplify/utils:  undefined ()
    buffer: ^4.9.2 => 4.9.2 (5.7.1)
    jasmine-core: ~4.5.0 => 4.5.0 
    karma: ~6.4.0 => 6.4.3 
    karma-chrome-launcher: ~3.1.0 => 3.1.1 
    karma-coverage: ~2.2.0 => 2.2.1 
    karma-coverage-coffee-example:  1.0.0 
    karma-jasmine: ~5.1.0 => 5.1.0 
    karma-jasmine-html-reporter: ~2.0.0 => 2.0.0 
    moment: ^2.29.4 => 2.30.1 
    rxjs: ~7.8.0 => 7.8.1 
    rxjs/ajax:  undefined ()
    rxjs/fetch:  undefined ()
    rxjs/operators:  undefined ()
    rxjs/testing:  undefined ()
    rxjs/webSocket:  undefined ()
    tslib: ^2.3.0 => 2.6.3 (2.6.2, 1.14.1)
    typescript: ~5.4.5 => 5.4.5 
    zone.js: ~0.14.7 => 0.14.8

Describe the bug

I am using Angular version 17.3.12 and Amplify v6.4.2.
Using hosted UI as login method.
We are make use of the Single sign on since we have multiple angular applications.
Also, using Cookie storage as the storage mechanism for the amplify library.

The scenario is,
[Consider I have 2 applications named App1 & App2]

Login from App1(Have a landing page which contain a button which redirect to the cognito hosted ui (login page)
If the login is success, i am able to switch the applications, so i can go with App2.
Both applications using our custom library(A header section) , that contain logout button

Case 1:
              If I try to logout from the App1, it will successfully logout, and redirect to landing page

Case 2:
              If I try to logout from App2, it WON'T LOGOUT and no action is happening.
              Note: Observed that cookie is cleared. But if we refresh the tab, it will redirect to the landing page. 
              But upon clicking the login button, it will directly enter to the application home page 
              without prompting the credentials.

Expected behavior

While using Single sign on with my applications having same domain, expected to completely logout from all the linked applications seamlessly.

Reproduction steps

Enable single sign on for multiple applications; say App1, App2, etc..
Login using one application; say App1
Navigate to App2 [Use cookie storage to share the token and other auth informations]
Try to logout from the App2.

Code Snippet

import { Hub } from "aws-amplify/utils";
import { getCurrentUser, signInWithRedirect } from "aws-amplify/auth";

// Constructor of the landing page
constructor(private router: Router,
    private zone: NgZone) {
    // Used for listening to login events
    Hub.listen("auth", ({ payload }) => {
      switch (payload.event) {
        case 'signedIn':
        case "signInWithRedirect":
          this.zone.run(() => this.router.navigate(['/app/home']));
          break;
        default:
          // handle sign in failure
          this.zone.run(() => this.router.navigate(['/login']));
          break;
      }
    });

    //currentAuthenticatedUser: when user comes to login page again
    getCurrentUser()
      .then(() => {
        this.router.navigate(['/app/home'], { replaceUrl: true });
      }).catch((err) => {
        this.router.navigate(['/login']);
      })

  }


// This function is triggered when clicking "Login"
onLoginClick() {
    signInWithRedirect();;
}



// This function is triggered when we click on Logout
logout(){
    signOut({ global: true })
      .then(data => {
        console.log(data)
  })
      .catch(err => {
        console.log(err)
        signOut();
      });
  }

Log output

// Put your logs below this line

aws-exports.js

import { environment } from "../src/environments/environment";
import { ResourcesConfig } from "aws-amplify";
const awsAmplifyConfig: ResourcesConfig = {
    Auth: {
        Cognito: {
            userPoolId: environment.cognitoUserPoolId,
            userPoolClientId: environment.cognitoAppClientId,
            signUpVerificationMethod: 'code',
            loginWith: {
                oauth: {
                    domain: environment.cognitoAuthDomain,
                    scopes: [
                        "phone",
                        "email",
                        "openid",
                        "profile",
                        "aws.cognito.signin.user.admin"
                    ],
                    redirectSignIn: ['https://app1.dev.mydomain.com/app/home'],
                    redirectSignOut: ['https://app1.dev.mydomain.com/login'],
                    responseType: 'code'
                }
            }
        }
    }
};



export default awsAmplifyConfig;

Manual configuration

import { Amplify } from 'aws-amplify';
import { CookieStorage } from 'aws-amplify/utils';
import { cognitoUserPoolsTokenProvider } from 'aws-amplify/auth/cognito';
import awsAmplifyConfig from './aws-exports';


Amplify.configure(awsAmplifyConfig);

cognitoUserPoolsTokenProvider.setKeyValueStorage(new CookieStorage(environment.cookieStorage));

environment.cookieStorage

cookieStorage: {
    // - Cookie domain (only required if cookieStorage is provided)
    domain: `.mydomain.com`,
    // (optional) - Cookie path
    path: '/',
    // (optional) - Cookie expiration in days
    expires: 1,
    // (optional) - See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite
    sameSite: `strict` as const,

    // (optional) - Cookie secure flag
    // Either true or false, indicating if the cookie transmission requires a secure protocol (https).
    secure: true,
  },

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

The text was updated successfully, but these errors were encountered:

israx · 2024-07-24T17:09:59Z

hello @SajithTS. Sorry to hear you are experiencing issues with the library. I'd like to get some context, could you elaborate on the following questions bellow.

How did you configure SSO for App1 and App2?
Can you confirm if the flow bellow is accurate?

click signInWithRedirect App1 -> redirect to App1 -> finish authenticating -> redirect to App 2 -> log out

are you able to call getCurrentUser API on App2?
are the attached code snippets above for App1?
how is signOut not working? are you still able to see auth tokens ?

SajithTS · 2024-07-25T05:13:32Z

Hello @israx
1.

How did you configure SSO for App1 and App2?

Configured the SSO by using same userPoolId, userPoolClientId, cognitoAuthDomain and 
same Application domain

Can you confirm if the flow bellow is accurate?
click signInWithRedirect App1 -> redirect to App1 -> finish authenticating -> redirect to App 2 -> log out

Yes. The flow is correct

are you able to call getCurrentUser API on App2?

Yes. getCurrentUser is working as expected

are the attached code snippets above for App1?

Yes. Same code is using in the App2 as well (Except "signInWithRedirect() API")

how is signOut not working? are you still able to see auth tokens ?

When I click the signout button, stay in the present page. Not redirecting to the login/landing page. 
But auth details including tokens are cleared from the cookie.
Then if I refresh the page, it will redirect to landing page. Then clicking the login button, 
take me to the App1 home page without asking the credentials

NOTE: SSO and the logout functionalities were working fine with the Amplify 5.2.4 version. After the Amplify 6 upgrade, facing this issue

SajithTS · 2024-07-25T05:23:11Z

@israx
I can see that a parameter has been added to the local storage of App1.
The key name is

CognitoIdentityServiceProvider.CLIENT_ID.oauthSignIn

The value for the above parameter is

true,false

But this Key-value is not present in the local storage of App2.

israx · 2024-07-25T20:00:03Z

Hey @SajithTS. Before calling the signOut API on APP2, make a call to Amplify.getConfig and see if you have a valid oauth configuration.

The library will validate this oauth config and will call the oauth endpoint that redirects back to the app. If there is not a valid oauth config, you might need to call Amplify.configure on App2.

SajithTS · 2024-07-26T05:36:07Z

Hello @israx . I am calling Amplify.configure in the main.ts file of both App1 & App2.

To make sure the configuration is correct, i have printed the configuration value while calling the logout function.

The logout function definition used in the App2 and App1 is given below:

onLogoutClick() {
    let a = Amplify.getConfig();
    console.log('Amplify config >> ', a)
    signOut({ global: true })
      .then(data => console.log(data))
      .catch(err => {
        console.log(err)
        signOut();
      });
  }

The console output for the above code snippet is given here:

{
    "Cognito": {
        "loginWith": {
            "oauth": {
                "domain": "COGNITO_DOMAIN",
                "redirectSignIn": [
                    "https://app1.dev.mydomain.com/app/home"
                ],
                "redirectSignOut": [
                    "https://app1.dev.mydomain.com/login"
                ],
                "responseType": "code",
                "scopes": [
                    "phone",
                    "email",
                    "openid",
                    "profile",
                    "aws.cognito.signin.user.admin"
                ]
            }
        },
        "signUpVerificationMethod": "code",
        "userPoolClientId": "CLIENT_ID",
        "userPoolId": "POOL_ID"
    }
}

The output is same from both App1 & App2.

israx · 2024-07-26T16:35:02Z

hello @SajithTS. Your comment led me to determine the root cause of the issue.

The oauthSignIn key is used to determine if a user logged in via an oauth flow. This key is only stored on localStorage. So the moment App2 logs out, it doesn't have access to it.

I'll mark this issue as a bug. In the meantime, a heuristic workaround is to manually set the oauthSignIn key on the localStorage of App2.

SajithTS · 2024-07-26T18:26:05Z

Hey @israx . With reference to your previous comment, I have manually set the oauthSignIn in the local storage of the App2.
The code for setting the localStorage value is written in the layout class (This class is accessible only for the authenticated users).
Here is the code:

localStorage.setItem(`CognitoIdentityServiceProvider.${environment.cognitoAppClientId}.oauthSignIn`,`true,false`);

Value is successfully stored in localStorage of App2 and now the localStorage of App1 & App2 are identical.

Result:
If I try to logout from the App2, the following error is thrown and there is no redirection to the login page. Stay in the present page.

InvalidOriginException: redirect is coming from a different origin. 
The oauth flow needs to be initiated from the same origin
    at 38908 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:162389:32)
    at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
    at 15199 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:168598:79)
    at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
    at 53205 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:165710:68)
    at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
    at 44920 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:163521:86)
    at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)
    at 32651 (https://app2.dev.mydomain.com/main.10d371c6677ed14b.js:164042:92)
    at __webpack_require__ (https://app2.dev.mydomain.com/runtime.7d29bb8b82c466c4.js:23:42)

israx · 2024-07-26T19:25:14Z

I see you have the following domains https://app1.dev.mydomain.com/app/home and
https://app2.dev.mydomain.com/app/home. And you want to logout from domain2 and redirect to domain1. So this flow is not supported at the moment. However, we have a beta version that is being worked on and that you can use to overwrite the actual redirectSignOut from your oauth config.

You should be able to do it via the options of the signOut API.

SajithTS · 2024-07-27T17:04:30Z

@israx . Thank you for your prompt response and assistance.
I will keep you updated on the results once I have completed the testing.

SajithTS · 2024-07-30T09:48:25Z

Hey @israx. Thank you for releasing the beta version. I have tested it in my project, and it is working fine. Could you please let me know when you anticipate releasing a stable version of this beta?

Note: Currently i'm manually setting the oauthSignIn (comment)

Do we plan on setting this key into local storage from Amplify library itself while initialising the application, so that users don't have to set it manually every time. Because this was not an issue in Amplify v5.

israx · 2024-08-08T17:42:33Z

Hello @SajithTS. We are looking into this issue, will follow up with any updates

Samaritan1011001 · 2024-09-11T23:24:44Z

@SajithTS Both the fixes have been released with the latest version, please update and verify it resolves the issue.

Documentation is also now available in Gen2, Gen1

SajithTS · 2024-09-12T10:31:04Z

@Samaritan1011001 Thanks for the update. I'll test with the latest version and will give you the updates.

cwomack · 2024-10-04T20:10:39Z

Hey, @SajithTS 👋. Wanted to check in and see if you had a chance to test the latest version. Let us know if you're still blocked by this.

SajithTS · 2024-10-07T04:14:03Z

Hi, @cwomack @Samaritan1011001 @israx

Thank you for addressing the issue. I’ve tested the new version (amplify v6.6.2), and I can confirm that the issue has been resolved.

Everything is working as expected now, and I appreciate the quick response and the fix!

Thanks again for your hard work on this project.

cwomack · 2024-10-07T21:00:00Z

Hey, @SajithTS that's great to hear! Appreciate you following up with the confirmation that you're unblocked. We'll close out the issue then.

SajithTS added the pending-triage Issue is pending triage label Jul 24, 2024

cwomack added question General question Auth Related to Auth components/category pending-response and removed pending-triage Issue is pending triage labels Jul 24, 2024

cwomack self-assigned this Jul 24, 2024

github-actions bot removed the pending-response label Jul 25, 2024

israx added bug Something isn't working and removed question General question labels Jul 26, 2024

github-actions bot added the pending-maintainer-response Issue is pending a response from the Amplify team. label Sep 11, 2024

nadernt mentioned this issue Sep 27, 2024

Here's a revised version of your text: Bug in fetchAuthSession with the {forceRefresh:true} parameter causes an error. #12749

Closed

3 tasks

github-actions bot removed the pending-maintainer-response Issue is pending a response from the Amplify team. label Oct 4, 2024

cwomack added the pending-community-response Issue is pending a response from the author or community. label Oct 4, 2024

github-actions bot added pending-maintainer-response Issue is pending a response from the Amplify team. and removed pending-community-response Issue is pending a response from the author or community. labels Oct 7, 2024

cwomack closed this as completed Oct 7, 2024

github-actions bot removed the pending-maintainer-response Issue is pending a response from the Amplify team. label Oct 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Amplify 6 logout issue with Single sign on #13638

Amplify 6 logout issue with Single sign on #13638

SajithTS commented Jul 24, 2024 •

edited

Loading

israx commented Jul 24, 2024 •

edited

Loading

SajithTS commented Jul 25, 2024

SajithTS commented Jul 25, 2024 •

edited

Loading

israx commented Jul 25, 2024

SajithTS commented Jul 26, 2024

israx commented Jul 26, 2024 •

edited

Loading

SajithTS commented Jul 26, 2024

israx commented Jul 26, 2024

SajithTS commented Jul 27, 2024

SajithTS commented Jul 30, 2024 •

edited

Loading

israx commented Aug 8, 2024

Samaritan1011001 commented Sep 11, 2024

SajithTS commented Sep 12, 2024

cwomack commented Oct 4, 2024

SajithTS commented Oct 7, 2024 •

edited

Loading

cwomack commented Oct 7, 2024

Amplify 6 logout issue with Single sign on #13638

Amplify 6 logout issue with Single sign on #13638

Comments

SajithTS commented Jul 24, 2024 • edited Loading

Before opening, please confirm:

JavaScript Framework

Amplify APIs

Amplify Version

Amplify Categories

Backend

Environment information

Describe the bug

Expected behavior

Reproduction steps

Code Snippet

Log output

aws-exports.js

Manual configuration

Additional configuration

Mobile Device

Mobile Operating System

Mobile Browser

Mobile Browser Version

Additional information and screenshots

israx commented Jul 24, 2024 • edited Loading

SajithTS commented Jul 25, 2024

SajithTS commented Jul 25, 2024 • edited Loading

israx commented Jul 25, 2024

SajithTS commented Jul 26, 2024

israx commented Jul 26, 2024 • edited Loading

SajithTS commented Jul 26, 2024

israx commented Jul 26, 2024

SajithTS commented Jul 27, 2024

SajithTS commented Jul 30, 2024 • edited Loading

israx commented Aug 8, 2024

Samaritan1011001 commented Sep 11, 2024

SajithTS commented Sep 12, 2024

cwomack commented Oct 4, 2024

SajithTS commented Oct 7, 2024 • edited Loading

cwomack commented Oct 7, 2024

SajithTS commented Jul 24, 2024 •

edited

Loading

israx commented Jul 24, 2024 •

edited

Loading

SajithTS commented Jul 25, 2024 •

edited

Loading

israx commented Jul 26, 2024 •

edited

Loading

SajithTS commented Jul 30, 2024 •

edited

Loading

SajithTS commented Oct 7, 2024 •

edited

Loading