godaddy / godaddy/aws-okta-processor
SAML not working with MFA in Okta Identity Engine
- Dominant language
- Python
- Stars
- 90
- Forks
- 24
- PR merge metrics
- No merged PRs in 30d
Description
Using the new Okta identity engine, I set my ~/.aws/config file with a profile
```
[profile trial]
region = us-gov-west-1
credential_process = aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200
```
then I ran
`aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200`
which resulted in
```
Password:
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
Creating new Okta session.
Password:
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
ERROR: SAMLResponse tag was not found!
```
Also ran the above command appending `--factor push:okta` and `--factor token:software:totp:okta` which yielded the same error.
It seems aws-okta-processor may not function properly with the Okta Identity Engine. Can this be fixed for a future release?
Thank you.
(customer sensitive info removed)
Contributor guide
Assessment
This issue has not been assessed yet.