Handle regional SAML ACS URLs

[epierce]

Description

For multi-region failover, Okta may send region-specific ACS Urls instead of https://signin.aws.amazon.com/saml. Handle that case and use the same region for the STS endpoint

Related Issue

413

Motivation and Context

The standard SAML sign-in endpoint (https://signin.aws.amazon.com) points at US-East-1 and does not have any type of regional failover if US-East-1 fails. Amazon currently has no plans to make this endpoint failover automatically between regions, so everyone has to handle regional failures by manually pointing Okta to a working region when US-East-1 is not available. Details here: https://aws.amazon.com/blogs/apn/improve-the-availability-of-existing-okta-iam-federation-setup-using-multi-region-saml-endpoints

How Has This Been Tested?

• unit tests
• integration testing with multiple regions in AWS and AWS-CN

Types of changes

• [ ] Bug fix (non-breaking change which fixes an issue)
• [x] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• [x] My code follows the code style of this project.
• [ ] My change requires a change to the documentation.
• [ ] I have updated the documentation accordingly.
• [x] I have read the CONTRIBUTING document.
• [x] I have added tests to cover my changes.
• [x] All new and existing tests passed.