Cognito User Pool External Identity Provider (Auth0) Returns Error at /oauth2/idpresponse

The issue you're experiencing with Cognito User Pool and your external Identity Provider (Auth0) seems to be related to how Cognito is handling the response from Auth0. There are a few potential reasons for this error:

1. Configuration mismatch: There might be a discrepancy between the configuration in your Cognito User Pool and the settings in Auth0. This could include mismatched client IDs, redirect URIs, or other OAuth parameters.

2. Missing or incorrect parameters: The /oauth/idpresponse endpoint might be expecting certain parameters that are not being passed correctly from Auth0. This could include the client_id, which is sometimes dropped during the redirection process.

3. Token or claim issues: Cognito might be having trouble validating the token or claims received from Auth0. This could be due to incorrect signature validation, mismatched issuers, or other OIDC/OAuth specification violations.

4. Metadata issues: If Cognito is unable to access or process the metadata from Auth0, it could lead to this kind of error.

To troubleshoot this issue:

1. Double-check all configuration settings in both Cognito and Auth0 to ensure they match exactly.

2. Verify that all required OAuth parameters are being passed correctly through the entire flow.

3. Check the Auth0 logs for any errors or warnings during the authentication process.

4. Ensure that the Auth0 metadata URL is publicly accessible and contains all required information.

5. If possible, try using a different external IdP temporarily to see if the issue is specific to Auth0 or if it's a general Cognito configuration problem.

6. Consider capturing and analyzing the network traffic during the authentication flow to see exactly what's being passed between the different systems.

If the issue persists after these checks, you may need to open a support case with AWS to get more detailed error information and assistance. They can provide access to logs that aren't publicly visible and can help diagnose issues specific to your Cognito configuration.
Sources
Cognito User Pool SAML Federation throwing Unable to contact the configured provider | AWS re:Post
Managed login and federation error responses - Amazon Cognito
ERROR: Bad id_token issuer https://www.linkedin.com/oauth&error=invalid_request when using cognito and using LinkedIn as OIDC provider | AWS re:Post

The issue occurred because though I configured Auth0 as an external IdP, I did not add this idP as an identity provider to the Cognito User Pool client.

To do this, I followed these steps:

1. From the User Pool page, click on "App clients" in the left-hand menu under "Applications"
2. Select your app client from the list that you'd like to use with the IdP
3. Midway down the page, click on the "Login Pages" tab
4. Click the "Edit" button to modify the Login Pages config
5. Under "Identify Providers", add your new IdP in addition to the "Cognito user pool" identity provider

It works now.