{
  "_meta": {
    "broker": "AWS Cognito (User Pool -> Federated Identity Providers -> OIDC)",
    "purpose": "Federate a Cognito User Pool to a CodeB Sovereign Communications tenant so users can sign in with 'European Digital Identity Wallet' (or any other CodeB method) and land as Cognito users.",
    "instructions": "https://<CODEB_TENANT_HOST>/iam-integrations.html#cognito",
    "cli_hint": "aws cognito-idp create-identity-provider --cli-input-json file://cognito-oidc-idp-config.json",
    "replace": ["<COGNITO_USER_POOL_ID>", "<CODEB_TENANT_HOST>", "<CLIENT_ID>", "<CLIENT_SECRET>"]
  },
  "UserPoolId": "<COGNITO_USER_POOL_ID>",
  "ProviderName": "CodeB",
  "ProviderType": "OIDC",
  "ProviderDetails": {
    "client_id": "<CLIENT_ID>",
    "client_secret": "<CLIENT_SECRET>",
    "attributes_request_method": "GET",
    "oidc_issuer": "https://<CODEB_TENANT_HOST>",
    "authorize_scopes": "openid profile email",
    "authorize_url": "https://<CODEB_TENANT_HOST>/oidc.ashx/authorize",
    "token_url": "https://<CODEB_TENANT_HOST>/oidc.ashx/token",
    "attributes_url": "https://<CODEB_TENANT_HOST>/oidc.ashx/userinfo",
    "jwks_uri": "https://<CODEB_TENANT_HOST>/.well-known/jwks.json"
  },
  "AttributeMapping": {
    "email":              "email",
    "email_verified":     "email_verified",
    "preferred_username": "preferred_username",
    "username":           "sub",
    "custom:codeb_role":         "role",
    "custom:eudi_verified":      "eudi_verified",
    "custom:wallet_attestation": "wallet_attestation"
  },
  "_post_setup": [
    "1. Register the CodeB provider on your Cognito User Pool app client (Cognito console -> App integration -> App client settings -> Enabled identity providers).",
    "2. Cognito's callback URL is https://<COGNITO_DOMAIN>/oauth2/idpresponse -- allow-list it on the CodeB OIDC client at /oidc-clients.html on your tenant.",
    "3. Custom Cognito attributes (custom:codeb_role, custom:eudi_verified, custom:wallet_attestation) must be created on the User Pool BEFORE the AttributeMapping above will accept them.",
    "4. Verify: hit https://<COGNITO_DOMAIN>/oauth2/authorize?identity_provider=CodeB&response_type=code&client_id=<APP_CLIENT_ID>&scope=openid+email&redirect_uri=<YOUR_APP_CALLBACK>"
  ]
}