OpenID Connect Cognito group scope configuration (OIDC)

LeonBowers2 — Mon, 16 Jun 2025 07:15:18 GMT

Hi,

We’ve enabled OpenID Connect (OIDC) logins in AGOL and can successfully authenticate users and create accounts with the scopes below:

We want to enable AGOL group membership based upon OIDC groups but can’t get the scopes correct. This is what is being returned from Cognito for a test user:

       "groups": [
           "corporate_user",
           "projects_user-aswa"
       ],

When updating the provider scopes to include groups, our login using OIDC breaks.

Results in:

I’ve tried many different values for the scope including groups[] and variations of it, but can’t get it correct.

Any idea what the scope syntax in AGOL should be or should we change the groups JSON format in Cognito to something different?

Thanks,

Leon.

topic OpenID Connect Cognito group scope configuration (OIDC) in ArcGIS Online Questions

OpenID Connect Cognito group scope configuration (OIDC)