Cognito User Custom Attribute Doesn't Update from Federated IdP When OIDC Claim Doesn't Exist

Question

When I'm using Cognito with a federated identity provider, and I'm mapping the custom string attribute of "custom:roles" to the "roles" claim on the OIDC token from my provider, it works great when I'm going from no roles mapped -> some roles mapped. However, when I remove all roles from the provider side, so that the claim doesn't exist when it's returned to Cognito after sign in, the "custom:roles" attribute still shows the old roles, rather than removing the attribute entirely.

How can I fix this so that the roles attributes are synced across identity providers (Cognito and my own IdP)?

Answer

Before digging deeper, can you please verify that the custom attribute is mutable? If it is immutable, you can only write to it once. See Custom attributes section in the docs.

If it is mutable, please verify that your app client has the required write permission for that attribute - refer to the Attribute permissions and scopes section in the docs for more information.

If it is mutable, please verify that your app client has the required write permission for that attribute - refer to the [Attribute permissions and scopes ](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-attribute-permissions-and-scopes) section in the docs for more information.

Cognito User Custom Attribute Doesn't Update from Federated IdP When OIDC Claim Doesn't Exist

Relevant content