Skip to content

SAML not working with MFA in Okta Identity Engine #73

@andy-mehta

Description

@andy-mehta

Using the new Okta identity engine, I set my ~/.aws/config file with a profile

[profile trial]
region             = us-gov-west-1
credential_process = aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200

then I ran

aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200

which resulted in

Password: 
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
Creating new Okta session.
Password: 
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
ERROR: SAMLResponse tag was not found!

Also ran the above command appending --factor push:okta and --factor token:software:totp:okta which yielded the same error.

It seems aws-okta-processor may not function properly with the Okta Identity Engine. Can this be fixed for a future release?
Thank you.

(customer sensitive info removed)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions