Cognito well-known url(discovery document) doesn't have many other endpoints like revoke, logout

Question

Hi,
I am trying to use cognito but the discovery document via the url *https://cognito-idp.us-east-1.amazonaws.com//.well-known/openid-configuration* doesn't have endpoints like logout, revoke.

Is there a way to include them into the discovery document? Because I try to extract the endpoints from the discovery document. 
Currently it looks like this
`{
    "authorization_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/authorize",
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "issuer": "https://cognito-idp.us-east-1.amazonaws.com/userpool",
    "jwks_uri": "https://cognito-idp.us-east-1.amazonaws.com/userpool/.well-known/jwks.json",
    "response_types_supported": [
        "code",
        "token"
    ],
    "scopes_supported": [
        "openid",
        "email",
        "phone",
        "profile"
    ],
    "subject_types_supported": [
        "public"
    ],
    "token_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/token",
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post"
    ],
    "userinfo_endpoint": "https://xyz.auth.us-east-1.amazoncognito.com/oauth2/userInfo"
}`

Although cognito has logout and revoke endpoint but its not part of the discovery document url
Ex- https://mydomain.auth.us-east-1.amazoncognito.com/logout, https://mydomain.auth.us-east-1.amazoncognito.com/oauth2/revoke

Jeff Lombardo-AWS · Accepted Answer

You are this is not the case today.

Still the discovery endpoint is a JSON document, so nothing prevent you from hosting your own version with extended information as you see fit and point your information to it. While preferable, the RFC does not mandate that the discovery document is hosted on the same FQDN as the OIDC provider.

You can for example use a Lambda function that will retrieve the original document, enrich it it and return the result to the requester.

Cognito well-known url(discovery document) doesn't have many other endpoints like revoke, logout

Add your answer

Relevant content