Docs: adds allow sign-out URL step to Cognito #1138
Conversation
✅ Deploy Preview for pomerium-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
|
||
| Add the special Pomerium sign-out URL to Cognito's **Allowed sign-out URLs** list: | ||
|
|
||
| `https://{AUTHENTICATE_DOMAIN}/.pomerium/signed-out` |
There was a problem hiding this comment.
I think this should really be signed_out, with an underscore rather than a hyphen.
There was a problem hiding this comment.
@kenjenkins were you able to confirm that signed_out is correct?
There was a problem hiding this comment.
It's signed_out in the handler endpoint code here: https://github.com/pomerium/pomerium/blob/c84a251c933dd674211d0a96605e56abcb63fde1/authenticate/handlers.go#L91.
Denis has updated it in in his pending changelog PR as well: pomerium/pomerium@4dd8859.
| @@ -85,6 +85,14 @@ If you need to make changes after creating your pool, be aware that some setting | |||
|
|
|||
| You can choose whether to use your own **Domain Name**, or use an AWS-provided one. The AWS-provided domain names are in the format `https://${DOMAIN-PREFIX}.auth.${AWS-REGION}.amazoncognito.com` | |||
|
|
|||
| ### Configure allowed sign-out URLs | |||
There was a problem hiding this comment.
Sorry, one other question: would it make more sense for this to be included in the table with the other client settings (in step 3)? It seems similar to the "Callback URL(s)" setting. (Note: I haven't actually seen the Cognito settings page, so I don't actually know what order these settings appear in there.)
There was a problem hiding this comment.
@kenjenkins I thought that would've been a good place for the URL as well, but like you I haven't been able to see the settings page. I referenced @wasaga 's screenshot in https://github.com/pomerium/pomerium-zero/issues/1385. I think this would be the cleaner option, though.
There was a problem hiding this comment.
I created my own AWS account and tried to go through the process of setting up a user pool in Cognito. Here's a screenshot from what I think is the relevant settings page:
Based on that screenshot, I think it would make sense to put 'Allowed sign-out URLs' right after the 'Allowed callback URLs' row (line 78 above).
It looks like some of the other settings have been renamed ('OAuth 2.0 grant types' instead of 'Allowed OAuth Flows' and 'OpenID Connect scopes' instead of 'Allowed OAuth Scopes'). I'll file a separate issue for that.
|
@kenjenkins I'm aware there is some inconsistency with our example URLs in this guide. We can address that in the Cognito refresh ticket. For now, I just want to add this documentation for v0.25. |
Co-authored-by: Kenneth Jenkins <[email protected]>
Fixes #1134