[Alexanderamiri]

Why

GoogleSAML has no account chooser: a browser signed in to a personal Google account hits a dead-end 403 app_not_configured_for_user (#157). With the Google OIDC provider on managed login, the prompt=select_account that apps and the ALB send (#170) reaches Google. Stacked on #171. DRAFT: do not merge until the checklist below is done.

What

• internal_identity_providers default ["GoogleSAML"] → ["Google"]. One list feeds every internal app client (app-auth-sync) and auth-claims' FEDERATED_IDENTITY_PROVIDERS.
• Docs updated to describe the post-cutover state.

How verified

• terraform fmt -check -recursive terraform
• Expected plan: the app-auth-sync and auth-claims Lambda environments are updated in place. No Cognito pool, domain or client is replaced (Terraform manages no clients). After apply, the CI reconcile switches every internal client to Google and rewrites cognito-client-identity-provider, which restarts each auth app (app-secret-rollout).

Rollout: pre-cutover checklist

• feat(identity): managed-login branding per app client and prompt=select_account #170 is applied and every internal client has a branding style (loop in docs/cognito-google-setup.md step 3)
• feat(identity): switch the internal pool domain to managed login #171 is applied (describe-user-pool-domain --domain javabin-internal → ManagedLoginVersion: 2), and cupcake sign-in still works on GoogleSAML
• Internal-pool lockdown (fix(identity): lock down the internal Cognito pool #166) is live: REQUIRED_EMAIL_DOMAIN, no self sign-up, no COGNITO on internal clients
• /javabin/platform/google-oauth/internal/{client-id,client-secret} exist (the Google IdP is in the pool)
• frosting sends prompt: 'select_account' (javaBin/frosting PR), and any other SPA/backend sends COGNITO_EXTRA_AUTH_PARAMS
• Apps keyed by sub (check cupcake/frosting) can handle a new sub per user: Google users are Google_<sub> with a new sub. The platform keys on email
• Probe, with a test client that lists Google:

  DOMAIN=javabin-internal.auth.eu-central-1.amazoncognito.com
  curl -s -o /dev/null -w '%{redirect_url}\n' \
    "https://$DOMAIN/oauth2/authorize?response_type=code&client_id=<id>&redirect_uri=<callback>&scope=openid&identity_provider=Google&prompt=select_account" \
    | grep -q 'prompt=select_account' && echo OK || echo "prompt dropped"

  If it prints prompt dropped even on managed login, the Google-type provider does not get prompt: switch to an OIDC-type provider before cutting over

Rollout: after merge

1. python3 scripts/auth-doctor.py --app-yaml <app>/app.yaml for each auth app. Expect a redirect to accounts.google.com with prompt=select_account.
2. Sign in once with a personal Gmail active in the browser: Google must show the account chooser.
3. A week later: delete the 4 GoogleSAML_* users, the GoogleSAML provider and the Google Admin SAML app (docs/cognito-google-setup.md, "Decommission").

Rollback: revert to ["GoogleSAML"] (GoogleSAML still exists until decommission).

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 4 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool_domain.internal will be updated in-place
  ~ resource "aws_cognito_user_pool_domain" "internal" {
        id                              = "javabin-internal"
      ~ managed_login_version           = 1 -> 2
        # (8 unchanged attributes hidden)
    }

  # module.identity.aws_lambda_function.auth_claims will be updated in-place
  ~ resource "aws_lambda_function" "auth_claims" {
        id                             = "javabin-auth-claims"
        tags                           = {}
        # (23 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "FEDERATED_IDENTITY_PROVIDERS" = "GoogleSAML" -> "Google"
                # (2 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

  # module.lambdas.aws_iam_role_policy.app_auth_sync will be updated in-place
  ~ resource "aws_iam_role_policy" "app_auth_sync" {
        id     = "javabin-app-auth-sync:javabin-app-auth-sync"
        name   = "javabin-app-auth-sync"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "cognito-idp:CreateUserPoolClient",
                            "cognito-idp:UpdateUserPoolClient",
                            "cognito-idp:DeleteUserPoolClient",
                            "cognito-idp:DescribeUserPoolClient",
                            "cognito-idp:ListUserPoolClients",
                            "cognito-idp:ListIdentityProviders",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                        Sid      = "ManageAppClients"
                    },
                  + {
                      + Action   = [
                          + "cognito-idp:CreateManagedLoginBranding",
                          + "cognito-idp:DescribeManagedLoginBrandingByClient",
                          + "cognito-idp:DeleteManagedLoginBranding",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                      + Sid      = "ManageAppClientBranding"
                    },
                    {
                        Action   = "cognito-idp:ListUserPools"
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "FindPools"
                    },
                    # (3 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-26T14:01:56.000+0000" -> (known after apply)
      ~ source_code_hash               = "GvhzSxolQGY8f4/fMAxElLFmKIXk8607SS3v89Em3x4=" -> "HKStd1VAWlTHRUFr+guun1HqV1RHui7nc1qw1cRONzY="
        tags                           = {}
        # (21 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "INTERNAL_IDENTITY_PROVIDERS" = "GoogleSAML" -> "Google"
                # (5 unchanged elements hidden)
            }
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Plan updates 4 existing resources in place (0 add, 0 destroy): a Cognito domain managed-login version bump, a Lambda identity-provider env var change, an IAM policy gaining managed-login branding permissions, and a Lambda code/env update.

• 🔒 [security] The app_auth_sync IAM role policy gains a new Allow statement (ManageAppClientBranding) granting cognito-idp:CreateManagedLoginBranding, DescribeManagedLoginBrandingByClient and DeleteManagedLoginBranding on both user pools in eu-central-1 (553637109631). This widens the Lambda's permissions, so it is worth confirming it is needed for the managed login v2 change.
• 🔒 [security] The Cognito domain 'javabin-internal' moves managed_login_version from 1 to 2, changing the hosted login experience for internal users. Verify that the new login UI and branding are intended and that the internal users' sign-in flow is tested.
• ✅ [routine] Federated/internal identity provider configuration changes: FEDERATED_IDENTITY_PROVIDERS on auth_claims goes from 'GoogleSAML' to 'Google', and INTERNAL_IDENTITY_PROVIDERS on app_auth_sync goes from 'GoogleSAML' to 'Google'. This removes SAML as an identity provider in the auth flow, so users who depend on SAML login could be locked out. Confirm this is intentional and that SAML is no longer needed.
• ✅ [routine] app_auth_sync Lambda code is updated in place (source_code_hash changes). No replacement or destruction; routine deployment of new code.
• 💰 [cost] No new billable resources are created (0 to add). No NAT gateways, load balancers, or databases are involved, so cost impact is negligible.