How to set userinfo_endpoint for OIDC provider in Cognito?

0

Hello,

In Management console when you try to add Federated identity provider for a User pool in Cognito there is option to manually set endpoints like Issuer URL, UserInfo endpoint URL, etc.

When trying to do the same via awscli, CloudFormation, Terraform, etc, there are two problems:

  1. There is no option to set the UserInfo endpoint, and if I try to add it in provider_details parameter, the command is rejected:

InvalidParameterException: userinfo_url is not a valid key for oidc identity provider details.

  1. All the manual endpoint URLs are used "if Amazon Cognito didn't discover them at the oidc_issuer URL", but if the oidc_issuer URL is not a metadata document the command is again rejected:

InvalidParameterException: Unable to contact well-known endpoint

My use case is trying to setup LinkedIn OIDC provider. Their metadata document URL is: https://www.linkedin.com/oauth/.well-known/openid-configuration But actually the "Issuer" field in it is slightly different: https://www.linkedin.com/

If I manually set all the endpoints through the management console, integration works, but I want a way to do this from Infrastructure as a Code point of view.

asked a year ago592 views
1 Answer
3
Accepted Answer

Found the solution:

  1. userInfo url is actually called attributes_url in parameters
  2. Omitting the trailing slash for oidc_issuer somehow does not trigger the "well-known" metadata probe and this value is used as expected for Issuer. So: https://www.linkedin.com/ is bad, but https://www.linkedin.com is good.
answered a year ago
profile picture
EXPERT
reviewed 12 days ago
profile pictureAWS
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions