From cb6a0f4d56bcc45ccd59a12b5abd31aef03fb499 Mon Sep 17 00:00:00 2001 From: Alexanderamiri Date: Thu, 29 Oct 2026 22:46:15 +0100 Subject: [PATCH] feat(identity): switch the internal pool domain to managed login Managed login forwards prompt=select_account to Google, so heroes get the account chooser. Every app client has a branding style from app-auth-sync (previous change), which managed login needs to show a sign-in page. Co-Authored-By: Claude Opus 5.5 --- docs/cognito-google-setup.md | 2 +- terraform/platform/identity/variables.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/cognito-google-setup.md b/docs/cognito-google-setup.md index 8d09b58..7831401 100644 --- a/docs/cognito-google-setup.md +++ b/docs/cognito-google-setup.md @@ -82,7 +82,7 @@ forwards every `prompt` value except `none` to the IdP the user signs in with. S | A managed-login branding style per app client (Cognito defaults) | `app-auth-sync` (created with the client, backfilled by reconcile, deleted with the client) | automatic | | Apps send `prompt=select_account` to `/oauth2/authorize` | `COGNITO_EXTRA_AUTH_PARAMS` (generate-modules.py); SPA `extraQueryParams` etc. — see app-yaml-reference "Account chooser" | per app | | ALB sign-in (`routing.login`) sends it | `authentication_request_extra_params` in `terraform/modules/service-routing` | automatic, internal pool | -| Internal pool domain on managed login | `internal_managed_login_version` in `terraform/platform/identity/variables.tf` (1 → 2, an in-place update of the domain) | PR | +| Internal pool domain on managed login | `internal_managed_login_version = 2` in `terraform/platform/identity/variables.tf` (an in-place update of the domain; 1 = back to the classic UI) | done | The external pool's domains stay on the classic hosted UI. Nothing there needs `prompt`, and its clients get branding styles too, so it can move later with the same one-line change. diff --git a/terraform/platform/identity/variables.tf b/terraform/platform/identity/variables.tf index f904533..77ebbb6 100644 --- a/terraform/platform/identity/variables.tf +++ b/terraform/platform/identity/variables.tf @@ -21,7 +21,7 @@ variable "google_workspace_domain" { variable "internal_managed_login_version" { description = "Internal pool domain: 1 = classic hosted UI, 2 = managed login (forwards prompt=select_account to Google)" type = number - default = 1 + default = 2 validation { condition = contains([1, 2], var.internal_managed_login_version)