AWS Cognito OIDC provider fails with "error_description=No+access+token+in+OAuth+IdP+response" when federating with Azure AD B2C Custom Policy

The error "No access token in OAuth IdP response" typically occurs when Amazon Cognito is unable to properly process the response from your external identity provider (in this case, Azure AD B2C).

Your hypothesis about the issuer mismatch is likely correct. When Cognito configures an OIDC provider, it expects the tokens returned by the IdP to have an "iss" claim that exactly matches the issuer URL from the discovery document. In your case, there's a discrepancy between what Cognito expects (with the policy name included) and what Azure AD B2C is actually providing (without the policy name).

This is a known behavior with Azure AD B2C custom policies. The issuer in the tokens typically doesn't include the policy name segment, while the discovery endpoint URL does include it.

To resolve this issue, you have a few options:

1. Use the File Metadata approach instead of URL Metadata in your Cognito configuration. Download the OpenID configuration file manually, modify the issuer value to match what Azure AD B2C will actually use in tokens, and upload this modified file to Cognito.

2. Check if your Azure AD B2C custom policy can be modified to include the policy name in the token issuer claim. This would involve customizing the token issuance in your custom policy XML.

3. Configure your Cognito app client to specifically include the external IdP. In the Cognito console, go to your User Pool, select "App clients" under "Applications", choose your app client, go to the "Login Pages" tab, and ensure your Azure AD B2C IdP is added as an identity provider.

4. If possible, consider using Azure AD B2C built-in user flows instead of custom policies, as they might have better compatibility with Cognito's expectations.

If these approaches don't resolve the issue, you may need to open a support case with AWS to get more detailed error information and assistance specific to your configuration.
Sources
Managed login and federation error responses - Amazon Cognito
Cognito User Pool SAML Federation throwing Unable to contact the configured provider | AWS re:Post
Cognito User Pool External Identity Provider (Auth0) Returns Error at /oauth2/idpresponse | AWS re:Post

As an update to this question: I was able to obtain an access_token by adding the client ID value to the authorized scope values in AWS Cognito. The refresh_token appears when I include the offline_access scope. The message “No access token in OAuth IdP response” means exactly what it says—there was no access token returned in the response from Azure B2C.