Cognito-IDP missing default claims in access token

[dhensen]

Default claims are missing in the create_jwt method:

moto/moto/cognitoidp/models.py

Lines 521 to 537 in 7536c08

	def create_jwt(
	self,
	client_id: str,
	username: str,
	token_use: str,
	expires_in: int = 60 * 60,
	extra_data: Optional[Dict[str, Any]] = None,
	) -> Tuple[str, int]:
	now = int(time.time())
	payload = {
	"iss": f"https://cognito-idp.{self.region}.amazonaws.com/{self.id}",
	"sub": self._get_user(username).id,
	"client_id" if token_use == "access" else "aud": client_id,
	"token_use": token_use,
	"auth_time": now,
	"exp": now + expires_in,
	}

When comparing to the AWS docs (see link above), these fields are missing:

• device_key
  • not documented on the page I linked to
• version
  • not documented on the page I linked to
• origin_jti
• event_id
• scope
• iat
• jti

Example of the payload extracted from an access token generated by moto:

{
  "iss": "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_f3c2ac4ccfdc4ac1a37a22ddc517a47d",
  "sub": "7e4a989e-a8f1-452d-8fad-591e48147f98",
  "client_id": "tiv5vb8a6kjmwk0q8w9h5fu4x5",
  "token_use": "access",
  "auth_time": 1736349176,
  "exp": 1736352776,
  "username": "[email protected]"
}

Now my current problem is not having jti, because the way things are setup currently requires an access token that has jti for checking if the token is revoked.

This is how I generate the token, maybe I'm missing something here or have wrong assumptions about that this should do:

    c_idp.admin_create_user(
        UserPoolId=user_pool_id,
        Username=username,
        UserAttributes=[
            {"Name": "email", "Value": username},
        ],
        TemporaryPassword="Password123",
    )
    res1 = c_idp.admin_initiate_auth(
        UserPoolId=user_pool_id,
        ClientId=pool_client_id,
        AuthFlow="ADMIN_NO_SRP_AUTH",
        AuthParameters={
            "USERNAME": username,
            "PASSWORD": "Password123",
        },
    )

    res2 = c_idp.admin_respond_to_auth_challenge(
        UserPoolId=user_pool_id,
        ClientId=pool_client_id,
        ChallengeName="NEW_PASSWORD_REQUIRED",
        ChallengeResponses={
            "USERNAME": username,
            "NEW_PASSWORD": "Password1234",
        },
        Session=res1["Session"],
    )
    access_token = res2["AuthenticationResult"]["AccessToken"]

(c_idp is a boto3 client instantiated in the scope of a function decorated with @mock_aws)

Question

Is this left out intentionally or is this just something that was never implemented yet? Am I using the correct way to get an access token, or should I be using other apis?

Please advice.