godaddy / godaddy/aws-okta-processor

SAML not working with MFA in Okta Identity Engine

Open
#73 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
90
Forks
24
PR merge metrics
No merged PRs in 30d

Description

Using the new Okta identity engine, I set my ~/.aws/config file with a profile

```
[profile trial]
region = us-gov-west-1
credential_process = aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200
```

then I ran

`aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200`

which resulted in

```
Password:
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
Creating new Okta session.
Password:
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
ERROR: SAMLResponse tag was not found!
```

Also ran the above command appending `--factor push:okta` and `--factor token:software:totp:okta` which yielded the same error.

It seems aws-okta-processor may not function properly with the Okta Identity Engine. Can this be fixed for a future release?
Thank you.

(customer sensitive info removed)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.