are federated IDPs consulted on token refresh via cognito user pools?


As I understand it, when a user logs into a cognito user pool via federated IDP, the access token and refresh tokens are managed exclusively by cognito, so I can integrate with a single IDP and let cognito handle any details of the federated auth. This is exactly what I want, but I'm wondering if cognito is managing any corresponding refresh token for the federated IDP and checking in when a corresponding cognito token is refreshed. I'd like to be able to ensure that if the federated authentication is no longer valid then the cognito refresh will fail and wondering if cognito manages any of this automatically or if I need to integrate with the federated IDP and invalidate the corresponding user myself.

asked 2 years ago1056 views
1 Answer
Accepted Answer


Cognito doesn't validate with external IdP during refresh token flow, if the refresh token that is issued by Cognito is still valid, end-user can continue to get new access and id tokens from Cognito without needing to re-authenticate with the external IdP.

If you have a use-case that requires validation with external IdP then I'd recommend using a short-lived refresh token (1 hour is the shortest TTL for refresh token) and this will force sign-in when token expires.

answered 2 years ago
profile picture
reviewed 3 days ago
profile picture
reviewed 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions