The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigOptionaldomainProvider domain hosting the OAuth endpoints when they aren't on the issuer (used by OAuth proxy)
The issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Extracts user information from Cognito JWT payload
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Validates Cognito-specific configuration
StaticConfigConfigures Amazon Cognito from COGNITO_USER_POOL_ID + COGNITO_CLIENT_ID + AWS_REGION.
Mapping preserved byte-for-byte from the env block that previously lived in MJServer's config, plus the optional COGNITO_DOMAIN — the hosted-UI domain, which is the only place Cognito serves /oauth2/authorize and /oauth2/token. Token validation doesn't need it; anything that initiates a Cognito login does. Same env var name and host-only form MJExplorer already uses.
AWS Cognito authentication provider implementation