search

cevoaustralia / aws-google-auth

Provides AWS STS credentials based on Google Apps SAML SSO auth (what a jumble!)
MIT License
537 stars 181 forks source link

AssumeRoleWithSAML operation: Principal ARN is invalid #163

Open kirankraleti opened 4 years ago

kirankraleti commented 4 years ago

While selecting a role and hitting enter, below error shows up. Any fix?

Type the number (1 - 2) of the role to assume: 2 image

manzke commented 4 years ago

Hey I can help here. I had the same problem. The issue is the order you have entered the information in the google user profile. Google and AWS don't care, but this command line does. ;)

Doesn't work , arn:aws:iam::xxxx:saml-provider/Google,arn:aws:iam::xxx:role/sso-sysadmin

works , arn:aws:iam::xxx:role/sso-sysadmin,arn:aws:iam::xxxx:saml-provider/Google

manzke commented 4 years ago

issue is here: https://github.com/cevoaustralia/aws-google-auth/blob/master/aws_google_auth/amazon.py#L83

parsing for iam is not enough. it has to check for saml-provider

demon commented 4 years ago

There's actually another reason this can fail -- a space after the comma. I had configured <role_arn>, <provider_arn>.

A simple trim() on the values would avoid this.

stevemac007 commented 4 years ago

If you have a sample SAML response that we can write a test against to validate this, I'd be happy to included it in the codebase.

I'm trying to increase the test coverage with real(ish) world examples to increase the resilience.

stibi commented 3 years ago

@demon is right, I have just seen the problem because of a comma. strip() FTW.

mgab commented 3 years ago

Quite annoying issue, specially in large organizations where one does not have direct access to the google profile configuration...

I created a PR to try to fix this. Happy to discuss changes 😀