We have an Amazon Load Balancer sitting in front of our application with Cognito as our IdP. We can get to the login page. After the user logs in, they get a "401 Unauthorized" page with the url:
https://xxxxx.com/oauth2/idpresponse?code=xxxx&state=xxxx
What could be some reasons why we're getting this error? Amazon seems to have very light docs around this [0] & [1]. We've already made sure all the oauth2 endpoints are correct (oauth2/token, oauth2/authorize, etc). Not sure where else to look.
Our setup roughly looks like this: https://www.exampleloadbalancer.com/auth_detail.html
[1] https://aws.amazon.com/premiumsupport/knowledge-center/elb-configure-authentication-alb/
[2] https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html