search

aws-azure-login / aws-azure-login

Use Azure AD SSO to log into the AWS via CLI.
MIT License
587 stars 261 forks source link

Microsoft broke authentication with multiple roles #323

Open sydorovdmytro opened 3 months ago

sydorovdmytro commented 3 months ago

Hello people,

Since April 16 we have been facing a wired behavior of Microsoft that injects the .mcas.ms domain into the SAML URL: https://signin.aws.amazon.com.mcas.ms/saml?cas_app_landing_mgc=%7B%22sle%22%3Afalse%2C%22pt%22%3A0%7D

https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url

The app can see the role selection page (see the screenshot) but we can't finish the authentication and fail with Unable to recognize page state! A screenshot has been dumped to aws-azure-login-unrecognized-state.png. If this problem persists, try running with --mode=gui or --mode=debug

The aws-azure-login-unrecognized-state.png file:

aws-azure-login-unrecognized-state

Is there any plan to handle this behavior too?

morko commented 2 months ago

I have made a bit of a spaghetti code fix in my fork if it is any help for you:

https://github.com/aws-azure-login/aws-azure-login/compare/main...morko:aws-azure-login:main