search

LEGO / assume-aws-sso-role

An AWS credential process that uses AzureAD
10 stars 0 forks source link

Error when trying the example #13

Closed ffMathy closed 9 months ago

ffMathy commented 10 months ago

I assume that it is because there is something I need to configure, but I am not very good at AD in general.

Here's the error:

SAML token is {"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID '' named 'oidc2saml'. Send an interactive authorization request for this user and resource.\r\nTrace ID: d4ae847d-a62f-4093-9630-6243e6b70200\r\nCorrelation ID: b7ea0fdd-79bf-4e4e-8077-d30f13309110\r\nTimestamp: 2023-09-08 09:58:00Z","error_codes":[65001],"timestamp":"2023-09-08 09:58:00Z","trace_id":"d4ae847d-a62f-4093-9630-6243e6b70200","correlation_id":"b7ea0fdd-79bf-4e4e-8077-d30f13309110","suberror":"consent_required","claims":"{\"access_token\":{\"capolids\":{\"essential\":true,\"values\":[\"6cb5c9d3-ac6f-4183-b9bb-5d4c952dbd93\",\"e1694eae-eac2-4129-9da1-b91a1ca25311\"]}}}"} Assuming role in AWS using role ARN arn:aws:iam::038008314608:role/arn:aws:iam:::role/SSO-Admin and principal arn:aws:iam:::saml-provider/AzureAD

I replaced the sensitive information with <redacted>.

Can anyone help out?

ffMathy commented 9 months ago

This happened due to me trying to follow the guide here: https://github.com/LEGO/IAM-CommonTools-OIDC2SAML-TokenExchange/tree/main/Examples

But then I wasn't an owner of the application.