okay, Cognito isn’t built to act as a SAML IdP — it only consumes SAML, it doesn’t issue it. You can connect it to something like Okta or Azure AD as your SAML provider, but you can’t make other apps use Cognito as their SAML source.

If your goal is just to let users log in directly with Cognito, it’s best to stick with OAuth2 or OpenID Connect since that’s what it actually supports.