Control plane cognito redirecting to "arc-saas.net/authentication-service/auth/cognito"

[motadata-devops]

after accessing control plane url with sign in with cognito redirecting to https://arc-saas.net/authentication-service/auth/cognito even with custom domain setup.

is there any solution or something missing ?

[HarshitSF]

@motadata-devops Thanks for raising this. From the initial review, it appears the redirect issue may be caused by the COGNITO_AUTH_CALLBACK_URL value inside the Control Plane authentication-service Helm chart.

Currently, this environment variable is not receiving the correct Control Plane hostname during deployment, which would explain why Cognito is redirecting back to the default URL (https://arc-saas.net/authentication-service/auth/cognito) instead of the custom domain you’ve configured.

To help us confirm this, could you please share:

The value being set for COGNITO_AUTH_CALLBACK_URL in your Control Plane values.yaml.

The custom domain you have configured for the Control Plane.

Whether any other callback URLs or OAuth settings were customized in the Cognito User Pool App Client.

With this information, we can validate the callback configuration and suggest the correct template or chart updates if required.

[motadata-devops]

@HarshitSF thanks for your reply.
Here is default values.yaml which is files/control-plane/control-plane-helm-chart/templates/cm-authentication-service.yaml

Also i have checked running container "control-plane-app-helm-authentication-service-56dd6ffcdb-h6h79" and here is configmap data for reference

kubectl get configmaps control-plane-app-helm-cm-authentication-service -n control-plane -o yaml

test.yaml

Here i can see callback url is properly set.
COGNITO_AUTH_CALLBACK_URL: https://motadata.in/authentication-service/auth/cognito-auth-redirect

Also it is redirecting to
https://sf-arc-saas-lvwkf3.auth.us-west-2.amazoncognito.com/login?response_type=code&redirect_uri=https%3A%2F%2Farc-saas.net%2Fauthentication-service%2Fauth%2Fcognito-auth-redirect&state=client_id%3Dtata-elxsi-control-plane&client_id=5tr87lvnknl9428j3u1alg7us3

[HarshitSF]

@motadata-devops Upon further analysis, we identified that the redirection was originating from the frontend Docker image. Since the Angular image is built using the local config.json, the behaviour was tied to the way the existing image was prepared.
We are updating our README with clear and comprehensive steps for building and maintaining the frontend Docker image on our side. This will help streamline the overall setup and improve future maintainability.
We will share the updated details shortly.

[motadata-devops]

@HarshitSF Thanks for the quick response. waiting for update.

[motadata-devops]

@HarshitSF
i have updated the new image tag which you have create in PR which is control-plane-helm-chart/values.yaml.template, After that above error resolved. but after selecting sign in with cognito, i am able to go to cognito auth page it is redirecting to url ( https://motadata-wkh4s8.auth.ap-south-1.amazoncognito.com/login?response_type=code&redirect_uri=https%3A%2F%2Fmotadata.in%2Fauthentication-service%2Fauth%2Fcognito-auth-redirect&state=client_id%3Dtata-elxsi-control-plane&client_id=4e2n80srkd9ju9u4nkh2vmj426 ), but after login it shows UnauthorisedError.

[yeshamavani]

Hello @motadata-devops this error actually we throw from multiple locations of code and difficult to identify the exact cause
can you please share your server logs

[motadata-devops]

@yeshamavani please find error logs attached in txt file from control-plane-app-helm-authentication-service
Also i found redirect url shows "client_id%3Dtata-elxsi-control-plane", may be it could be suspicious or other issue ?
Also please share if i need to check any other logs for any other pods or container.

control-plane-app-helm-authentication-service-error.txt

[HarshitSF]

@yeshamavani please find error logs attached in txt file from control-plane-app-helm-authentication-service Also i found redirect url shows "client_id%3Dtata-elxsi-control-plane", may be it could be suspicious or other issue ? Also please share if i need to check any other logs for any other pods or container.

control-plane-app-helm-authentication-service-error.txt

@motadata-devops Thanks for sharing the logs.
To investigate further, I need a couple of details from your side:
From the control-plane values.yaml:
What is the configured clientId?
What is the configured publicKey?
From the auth_clients table in the non–control-plane Auth DB:
What are the values of client_id, client_secret, and redirect_url for this client?
We need to confirm that the clientId and publicKey defined in the control-plane configuration match the client_id and client_secret stored in the Auth DB. A mismatch between these values is one of the common causes of authentication or redirect issues.
Please share these values (masking sensitive parts if needed), so we can validate and proceed with troubleshooting.