Why IAM Identity center is not redirecting me to my app with an access token?

Based on your description, it sounds like you're experiencing an issue with the OAuth flow between your application, Amazon Cognito, and IAM Identity Center. The problem appears to be in the callback configuration.

When you're using IAM Identity Center as an identity provider for Cognito via SAML, and then using Cognito for OAuth authentication in your .NET IdentityServer4 app, there are several potential issues that could cause the redirect problem:

1. Invalid callback URL configuration: The callback URL in your Cognito user pool application client settings may not match the callback URL expected by your application. Ensure that the callback URL registered in Cognito exactly matches the one your application is using.

2. Trust relationship issues: There might be a problem with the trust configuration between IAM Identity Center and Cognito. Verify that the SAML configuration between IAM Identity Center and Cognito is correctly set up.

3. Region mismatch: If you've configured your application to use a different region than where your IAM Identity Center is actually configured, this can cause redirect issues. Double-check that you're using the correct region in your application configuration.

4. Application access permissions: Ensure that your user has been properly assigned access to the application in IAM Identity Center. Users need to have the appropriate permissions to access the application.

5. OAuth flow configuration: Verify that your OAuth flow configuration in your IdentityServer4 app is correctly set up to handle the token exchange with Cognito.

To fix this issue:

• Verify the callback URL in your Cognito user pool client settings
• Check that your application is properly registered in IAM Identity Center
• Ensure the user has the correct permissions assigned
• Confirm that the SAML configuration between IAM Identity Center and Cognito is correct
• Verify you're using the correct region in your application configuration

If you're still experiencing issues, you might need to examine the SAML assertions being passed between IAM Identity Center and Cognito to identify any potential misconfigurations in the identity flow.
Sources
Configure AWS CLI with SSO raise error regarding "primary email address is assigned in AWS Identity Center" | AWS re:Post
Troubleshooting IAM Identity Center issues - AWS IAM Identity Center
How to implement trusted identity propagation for applications protected by Amazon Cognito | AWS Security Blog