Got it, thanks for a quick response, currently investigating custom oidc + cognito to solve this, but found you guys and thought would be awesome to try to avoid all the configuration burden for the solution specified.