ShawnT.63519 (Customer) asked a question.
I have configured the SAML Advanced Sing-on Settings based on the docs, but the Role Value SAML Attribute is missing the second half of what should be there.
Example Group Name: AWS-123456789123-Team-Portal-Role
App Filter: amazon_aws
Group Filter: AWS-(?{{accountid}}\d+)-(?{{role}}[a-zA-Z0-9+=,.@\-_]+)
Role Value Pattern: arn:aws:iam::${accountid}:saml-provider/Okta,arn:aws:iam::${accountid}:role/${role}
The attribute returned by the SAML Response is:
<saml2:Attribute Name="https://aws.amazon.com/SAML/Attributes/Role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">arn:aws:iam::123456789123:saml-provider/Okta
</saml2:AttributeValue>
The ,arn:aws:iam::${accountid}:role/${role} part of the attribute is missing.
Hello @ShawnT.63519 (Customer),
I hope you are doing fine.
Please let me know if the following link helps you to troubleshoot the issue: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html
Regards,
Natalia
Okta Inc.
Hey @User16254393570754125507 (Okta) ,
Unfortunately that's not useful, there is no issue on the AWS side. The SAML Response was malformed, which is on the Okta side, not the AWS side.
That said, I did figure it out. I changed the App Filter property to active_directory instead of the AWS App, and it started working as intended. I'm not clear on why, since the AD Group was mapped to the app, but it works so I'm not going to get hung up on it.
@ShawnT.63519 (Customer)
Thank you for following up.
It is great to hear that it is working now.
Regards,
Natalia
Okta Inc.
I am seeing this same issue, the Role attribute is missing the IAM Role, it only contains the IDP ARN. Unlike @ShawnT.63519 (Customer) , no amount of fiddling with the app filter corrects it.
I have eight Okta Apps for AWS logins, none of which have been edited and have worked correctly for two years, and all 8 have stopped working, blocking our users from logging into the AWS Console.