Does Cognito IdP Issuer URI map to something similar to the other URIs and endpoints?

[ocr-lasagna]

Hello, I've been working on getting a user pool setup for an OIDC flow for our application, however I can't tell if the issuer uri is pointing to a real AWS (since it has the amazonaws.com in there) or if there's a different URI I can use that routes to ministack
{ "issuer": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_68crqg1nP", "jwks_uri": "http://localhost:4566/us-east-1_68crqg1nP/.well-known/jwks.json", "authorization_endpoint": "http://localhost:4566/oauth2/authorize", "token_endpoint": "http://localhost:4566/oauth2/token", "userinfo_endpoint": "http://localhost:4566/oauth2/userInfo", "end_session_endpoint": "http://localhost:4566/logout", }

Similar to the way the execute-api endpoints are mapped a little differently than for example what my CDK command dumps out

(That is, http://< ID >.execute-api.localhost:4566/prod/ vs the amazonaws.com one that CDK produces)

Any help would be greatly appreciated, thank you!

And thank you for all of your efforts in getting ministack going!

[jgrumboe]

Which version of ministack are you using?
There was a change/fix with release 1.3.32 that the well-known auto-discovery answers with endpoints pointing back to ministack.

You should point your SDK to http://localhost:4566/.well-known/openid-configuration for auto-discovery.

That should be a valid TypeScript example:

import { UserManager } from "oidc-client-ts";

export const userManager = new UserManager({
  authority: "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_123456789",
  metadataUrl: "http://localhost:4566/.well-known/openid-configuration",
  client_id: "your-client-id",
  redirect_uri: "http://localhost:3000/callback",
  post_logout_redirect_uri: "http://localhost:3000/logout",
  response_type: "code",
  scope: "openid email profile",
});

[ocr-lasagna]

I'm currently using v1.3.37, I was following this guide

https://awskarthik82.medium.com/how-to-add-keycloak-as-oidc-identity-provider-in-aws-cognito-95018415aa0

On connecting Cognito to a keycloak instance, and his demo uses the "issuer" field + "/oauth2/idresponse" as the redirect uri for the keycloak client, however as show in your example as well that points to amazonaws.com instead of anything locally as far as I can tell

Perhaps I need to find another guide if that idresponse is the incorrect field to be using for hooking keycloak up to it, as the issuer uri does not seem to point to anything

[Nahuel990]

Hi @ocr-lasagna the issuer field is correct as-is... Cognito uses that exact AWS URL inside the JWT iss claim, and SDKs only string-compare it. Nothing actually fetches it. The real endpoints (jwks_uri, token_endpoint, etc.) already point at localhost:4566 in the discovery doc, which is what oidc-client-ts uses via metadataUrl.

For the Keycloak guide you're following (that /oauth2/idpresponse callback) isn't implemented on our side yet. We have /saml2/idpresponse working for SAML upstreams, but the OIDC equivalent (so Keycloak can redirect back with a code and we exchange it for tokens) is missing.

SAML federation works end-to-end today; OIDC doesn't.

I'll open an issue to track it.

[ocr-lasagna]

Thank you so much! Also very much appreciate the very quick response + resolution, the ministack team rocks

Just to clarify, is there a unique URI setup for the oauth2/idresponse uri? That is do I use the localhost:4566/oauth2/idresponse or do I need to include the user pool id in the URI somewhere?

[Nahuel990]

You don't need the pool ID in the callback URL. Just use:

http://localhost:4566/oauth2/idpresponse

MS figures out the correct pool from the state parameter created during the /oauth2/authorize flow.

In Keycloak, set the client redirect URI to:

http://localhost:4566/oauth2/idpresponse

The missing OIDC federation callback support was added so after the full Keycloak -> Ministack login flow should work

In case you still hit issues, please open an issue with the Keycloak config and the error/logs and we'll take a look

[ocr-lasagna]

Awesome, thank you so much!