Open AlexMichaelJonesNC opened 2 years ago
any update on this ?
I believe I'm also running into this issue. The problem is in this code:
It's specifically only looking for https://signin.aws.amazon.com/saml, but it looks like the above trace has configured https://us-west-2.signin.aws.amazon.com/saml.
Once that check fails, the code incorrectly decides the response is of type "resume":
Using DUMP_CONTENT=true
helped me to diagnose this issue.
See here for more info on regional SAML endpoints: https://aws.amazon.com/blogs/security/how-to-use-regional-saml-endpoints-for-failover/
Note that https://signin.aws.amazon.com/saml is actually just us-east-1.
I'm encountering an error where I have a working SSO solution between okta and the "Amazon Single sign-on" service that AWS provides. I wanted to use saml2aws to be able to get API keys, but I'm repeatedly hitting an issue where saml2aws fails out with an error:
error authenticating to IdP: error retrieving saml response: cannot find state token
. Digging deep into this, theaws single sign-on
integration does not appear to have a state token like the older aws integration that saml2aws appears to support.I've attached a verbose log below, with company information removed. a CONTENT_DUMP=true can be provided if helpful, but I've already confirmed
var stateToken
is not present the response fromhttps://company.okta.com/home/amazon_aws_sso/*******/*******