1

I have created a sample custom app on AWS SSO and tried to authorize users with SAML.

The workflow is as follows:

  • User clicks custom app logo on SSO console and starts authentication flow. SAML IDP endpoint in this case is the endpoint which was created during custom application creation. Works ok.

  • AWS redirects to the defined ACS (Nest.js backend API server on localhost) with SAML Response. This also works ok. Response seems to be valid and includes all attributes etc.

  • Backend API validates the response and calls STS with AssumeRoleWithSAML command which sends the aforementioned SAML response to STS with role and principal ARNs. IDP endpoint is an accounts identity provider which has been created by AWS SSO. This does not work. It produces the following error:

An error occurred (InvalidIdentityToken) when calling the AssumeRoleWithSAML operation: Invalid base64 SAMLResponse (Service: AWSOpenIdDiscoveryService; Status Code: 400; Error Code: AuthSamlInvalidSamlResponseException; Request ID: 55120f74-c9e8-4dac-b416-370b771339e5; Proxy: null)

So basically the problem is that AWS do not accept or is not able to process SAML response which was created by AWS.

What I do not understand here? Different issuer IDs or certificates causing the error? Should I modify the SAML response before sending it back to AWS?

Edit: I made some changes to attribute mappings (see comments to this message) and it helped. However,now I get another type of error message:

InvalidIdentityToken: Issuer not present in specified provider (Service: AWSOpenIdDiscoveryService; Status Code: 400; Error Code: AuthSamlInvalidSamlResponseException;

I resolved this problem by creating a new identity provider on AWS IAM console and using the same custom application SSO meta data.

Marko Eskola
  • 717
  • 4
  • 11
  • It seems that I forgot to add https://aws.amazon.com/SAML/Attributes/Role and https://aws.amazon.com/SAML/Attributes/RoleSessionName to attribute mappings. I added these and also https://aws.amazon.com/SAML/Attributes/SourceIdentity (for future use) to attribute mappings and this helped a little bit. The error changed to InvalidIdentityToken: Issuer not present in specified provider (Service: AWSOpenIdDiscoveryService; Status Code: 400; Error Code: AuthSamlInvalidSamlResponseException; – Marko Eskola Oct 09 '21 at 09:04
  • I resolved the problem related to missing issuer by creating a new identity provider on AWS IAM console and using the same custom application SSO meta data. – Marko Eskola Oct 09 '21 at 10:58
  • If you found the solution yourself, consider adding it as an answer to your question. It makes it easier for others to find the answer as well, if they come here with the same or a similar problem – st.huber Oct 12 '21 at 11:07

0 Answers0