<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D54z000072DT6HCAWOkta Classic EngineSingle Sign-OnAnswered2024-03-25T11:17:29.000Z2021-06-29T08:40:19.000Z2021-07-06T10:38:15.000Z

KrzysztofS.97629 (Customer) asked a question.

gimme-aws-creds broke / AWS SSO

This night you changed something in SAML without any notice and our integration with AWS broke.

Web version works, but our CLI configuration with gimme-aws-creds stopped working.

 

Stacktrace:

Using password from keyring for my.mail@example.com

Multi-factor Authentication required.

webauthn: webauthn selected

Challenge with security keys ...

Please enter PIN:

 

Touch your authenticator device now...

 

Traceback (most recent call last):

 File "/usr/local/bin/gimme-aws-creds", line 17, in <module>

  GimmeAWSCreds().run()

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 468, in run

  self._run()

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 795, in _run

  for data in self.iter_selected_aws_credentials():

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 771, in iter_selected_aws_credentials

  for role in self.aws_selected_roles:

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 671, in aws_selected_roles

  selected_roles = self._get_selected_roles(self.requested_roles, self.aws_roles)

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 662, in aws_roles

  self.saml_data['SAMLResponse'],

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 653, in saml_data

  self._cache['saml_data'] = saml_data = self.okta.get_saml_response(self.aws_app['links']['appLink'])

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 646, in aws_app

  self._cache['aws_app'] = aws_app = self._get_selected_app(self.conf_dict.get('aws_appname'), self.aws_results)

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 599, in aws_results

  self.auth_session

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/main.py", line 581, in auth_session

  auth_result = self.okta.auth_session()

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/gimme_aws_creds/okta.py", line 181, in auth_session

  "session": response.cookies['sid'],

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/requests/cookies.py", line 328, in __getitem__

  return self._find_no_duplicates(name)

 File "/Users/myhost/Library/Python/3.7/lib/python/site-packages/requests/cookies.py", line 399, in _find_no_duplicates

  raise KeyError('name=%r, domain=%r, path=%r' % (name, domain, path))

KeyError: "name='sid', domain=None, path=None"


  • KrzysztofS.97629 (Customer)

    Also, it affects anybody using Okta as AWS SSO, not only our company. Many people are complaining.

  • rnhtn (rnhtn)

    Same problem... Suddenly, all previously working tools leveraging gimme-aws-creds library stopped working with the same error

  • KrzysztofS.97629 (Customer)

    Fortunately Nike merged my pull request for workaround and new version of gimme-aws-creds was working properly after few hours.

    But still, breaking change in the SAML integration (wrong cookie) was introduced without any warning. Affecting all users of AWS with Okta.

    And after a week still no acknowledgment from Okta side...

    Expand Post
  • rnhtn (rnhtn)

    Thanks for that information and your workaround Krzysiek!

This question is closed.
Loading
gimme-aws-creds broke / AWS SSO