AzureAD: unable to locate SAMLRequest URL, error authenticating to IdP #628

eliasericsson · 2021-03-08T20:10:49Z

Configured according to this documentation: aad

I'm trying to authenticate with saml2aws to AzureAD -> AWS SSO. Saml2aws reports that authentication to the identity provider fail, however in Azure AD the login attempts are all successful.

DEBU[0000] Running                                       command=login
DEBU[0000] check if Creds Exist                          command=login
DEBU[0000] Expand                                        name=/home/elias/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink                                name=/mnt/c/Users/EliasEricsson-Rydber/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists                            filename=/mnt/c/Users/EliasEricsson-Rydber/.aws/credentials pkg=awsconfig
Using IDP Account default to access AzureAD https://account.activedirectory.windowsazure.com
To use saved password just hit enter.
? Username
? Password ***********

DEBU[0007] building provider                             command=login idpAccount="account {\n  AppID: ********-****-****-****-************\n  URL: https://account.activedirectory.windowsazure.com\n  Username: ***@***\n  Provider: AzureAD\n  MFA: Auto\n  SkipVerify: false\n  AmazonWebservicesURN: urn:amazon:webservices\n  SessionDuration: 3600\n  Profile: saml\n  RoleARN: \n  Region: \n}"
Authenticating as ***@*** ...
DEBU[0008] HTTP Req                                      URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
DEBU[0008] HTTP Req                                      URL="https://login.microsoftonline.com:443/common/DeviceAuthTls/reprocess" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
unable to locate SAMLRequest URL
error authenticating to IdP
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
        github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:84
main.main
        command-line-arguments/main.go:177
runtime.main
        runtime/proc.go:225
runtime.goexit
        runtime/asm_amd64.s:1371

Running Ubuntu 20.04 (WSL2)

saml2aws --version
2.28.3

Very thankful for any help or suggestions!

The text was updated successfully, but these errors were encountered:

Csmithson-qh · 2021-03-09T23:23:00Z

We are also experiencing this at my company.

MinsonTFW · 2021-03-18T07:02:07Z

same issue in 2.28.4, however, 2.27.1 works for me, you can have a try

eliasericsson · 2021-03-22T09:38:25Z

This is what I get running 2.27.1:

❯ sa login --verbose
DEBU[0000] Running                                       command=login
DEBU[0000] check if Creds Exist                          command=login
DEBU[0000] Expand                                        name=/home/elias/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink                                name=/mnt/c/Users/EliasEricsson-Rydber/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists                            filename=/mnt/c/Users/EliasEricsson-Rydber/.aws/credentials pkg=awsconfig
Using IDP Account default to access AzureAD https://account.activedirectory.windowsazure.com
To use saved password just hit enter.
? Username ***@***
? Password ***********

DEBU[0004] building provider                             command=login idpAccount="account {\n  AppID: ********-****-****-****-************\n  URL: https://account.activedirectory.windowsazure.com\n  Username: ***@***\n  Provider: AzureAD\n  MFA: Auto\n  SkipVerify: false\n  AmazonWebservicesURN: urn:amazon:webservices\n  SessionDuration: 3600\n  Profile: saml\n  RoleARN: \n  Region: \n}"
Authenticating as elias.ericsson.rydberg@xperta.se ...
DEBU[0005] HTTP Req                                      URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0006] HTTP Res                                      Status="200 OK" http=client
DEBU[0006] HTTP Req                                      URL="https://login.microsoftonline.com:443/common/DeviceAuthTls/reprocess" http=client method=post
DEBU[0006] HTTP Res                                      Status="200 OK" http=client
DEBU[0006] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/BeginAuth" http=client method=POST
DEBU[0007] HTTP Res                                      Status="200 OK" http=client
Phone approval required.
DEBU[0007] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0007] HTTP Res                                      Status="200 OK" http=client
DEBU[0008] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
DEBU[0009] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0009] HTTP Res                                      Status="200 OK" http=client
DEBU[0010] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0011] HTTP Res                                      Status="200 OK" http=client
DEBU[0012] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0012] HTTP Res                                      Status="200 OK" http=client
DEBU[0012] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
DEBU[0012] HTTP Res                                      Status="200 OK" http=client
DEBU[0012] HTTP Req                                      URL="https://login.microsoftonline.com/kmsi" http=client method=POST
DEBU[0012] HTTP Res                                      Status="200 OK" http=client
DEBU[0012] HTTP Req                                      URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
DEBU[0014] HTTP Res                                      Status="200 OK" http=client
unable to locate SAMLRequest URL
error authenticating to IdP
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
        /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:72
main.main
        /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163
runtime.main
        /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204
runtime.goexit
        /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374

lincheney · 2021-05-03T15:33:31Z

I'm getting this issue too. saml2aws errors out after hitting https://login.microsoftonline.com:443/common/DeviceAuthTls/reprocess same as #628 (comment)
I think the issue was introduced in #573

Going by #569 (comment), the Working... message, which is being checked at https://github.com/versent/saml2aws/blob/v2.30.0/pkg/provider/aad/aad.go#L693, always appears, causing MFA to always be skipped.
This is what I get in response to the POST https://login.microsoftonline.com/common/login (after redirecting to https://device.login.microsoftonline.com/?request=XXXXXX):

<html><head><title>Working...</title></head><body><form method="POST" name="hiddenform" action="https://login.microsoftonline.com:443/common/DeviceAuthTls/reprocess"><input type="hidden" name="ctx" value="XXXXXXXXXXX" /><input type="hidden" name="flowtoken" value="XXXXXXXXXXX" /><noscript><p>Script is disabled. Click Submit to continue.</p><input type="submit" value="Submit" /></noscript></form><script language="javascript">document.forms[0].submit();</script></body></html>

rprieto · 2021-06-10T09:52:45Z

Hi,

We are facing the exact same issue. In our case the error is linked to our Conditional MFA policy:

I agree with @lincheney, this seems to be a regression bug added in version 2.28.0.
Here is our test results across versions:

Version	Without conditional policy	With conditional policy
2.26.2	Goes through MFA Calls `common/SAS/ProcessAuth` Errors with `ProcessAuth response unmarshal error`	Goes through MFA Calls `common/SAS/ProcessAuth` Errors with `ProcessAuth response unmarshal error`
2.27.0	Goes through MFA Calls `common/SAS/ProcessAuth` Errors with `Unable to locate IDP oidc form submit URL`	Goes through MFA Calls `common/SAS/ProcessAuth` Errors with `Unable to locate IDP oidc form submit URL`
2.27.1	Works	Works
2.28.0	Works	Does not reach MFA Calls `common/DeviceAuthTls/reprocess` Errors with `Unable to locate SAMLRequest URL`
2.30.0	Works	Does not reach MFA Calls `common/DeviceAuthTls/reprocess` Errors with `Unable to locate SAMLRequest URL`

eliasericsson · 2021-06-14T15:04:49Z

@rprieto Nice catch!

Found this in the Sign-Ins log:

This occurred due to 'Keep me signed in' interrupt when the user was signing in.

eliasericsson · 2021-06-14T20:24:40Z

Tried to disable KMSI, but that made no difference at all.

The error, as far as I can tell, is occuring in this function:

saml2aws/pkg/provider/aad/aad.go

Lines 974 to 986 in beaaece

    
           // data is embedded javascript 
        
           // window.location = 'https:/..../?SAMLRequest=......' 
        
           oidcResponseList := strings.Split(oidcResponseStr, ";") 
        
           var SAMLRequestURL string 
        
           for _, v := range oidcResponseList { 
        
           	if strings.Contains(v, "SAMLRequest") { 
        
           		startURLPos := strings.Index(v, "https://") 
        
           		endURLPos := strings.Index(v[startURLPos:], "'") 
        
           		if endURLPos == -1 { 
        
           			endURLPos = strings.Index(v[startURLPos:], "\"") 
        
           		} 
        
           		SAMLRequestURL = v[startURLPos : startURLPos+endURLPos] 
        
           	}

My guess is that it is trying to find the part in bold which is the SAML Request URL

Sys.Application.add_load( function() { Microsoft.Online.BOX.JS.Shared.CacheContentFile('https://account.activedirectory.windowsazure.com/1.0.0.3740/Unknown/en-US/WebControls/JS/PageLayout.js'); } );Sys.Application.add_load( function() { Microsoft.Online.BOX.JS.Shared.CacheContentFile('https://account.activedirectory.windowsazure.com/1.0.0.3740/Unknown/en-US/Shell/JS/Shell.js'); } );window.location = 'https://X-XXXXXXXXXXX.awsapps.com/start';Sys.Application.add_load( function() { Microsoft.Online.BOX.JS.Shared.CacheContentFile('https://account.activedirectory.windowsazure.com/1.0.0.3740/Unknown/en-US/WebControls/JS/Button.js'); } );$addHandler(window.document.documentElement, 'mouseup', Button.MouseUp); Sys.Application.add_init(Button.ResizeButtons);var DialogManager = new BOX.JS.DialogManager();

This however results in new errors further down the line if I just write it explicitly:

error authenticating to IdP: error retrieving oidc login form results: Get "X-XXXXXXXXXX.awsapps.com/start": unsupported protocol scheme ""

In the browser is would yield this result, which allows fetching the keys. I assume saml2aws does the same thing:

rprieto · 2021-06-14T21:50:56Z

Hi. We might be having different issues. For us, the 2.28.0 issue doesn't seem related to KMSI, since the crash happens before MFA.

Since 2.28.0, it crashes as soon as we enables the conditional device state check (and works again when we disable the check, i.e. aways require MFA).

eliasericsson · 2021-06-14T22:15:22Z

Perhaps, I've tried device state on my end, on both 2.27.1 and 2.30.0 with the same result. So we seem to hit different road blocks 😄

error authenticating to IdP: unable to locate SAMLRequest URL

eliasericsson · 2021-06-24T15:08:09Z

The primary issue that saml2aws is unable to acquire the SAMLRequestURL. Circumventing that by hardcoding it to SAMLRequestURL = "https://x-xxxxxxxxxx.awsapps.com/start", the next hurdle is getting an action from a form?:

saml2aws/pkg/provider/aad/aad.go

Lines 1084 to 1105 in beaaece

    
           func (ac *Client) reProcess(resBodyStr string) (*http.Response, error) { 
        
           	doc, err := goquery.NewDocumentFromReader(strings.NewReader(resBodyStr)) 
        
           	if err != nil { 
        
           		return nil, errors.Wrap(err, "failed to build document from response") 
        
           	} 
        
           	var action, ctx, flowToken string 
        
           	doc.Find("form").Each(func(i int, s *goquery.Selection) { 
        
           		action, _ = s.Attr("action") 
        
           	}) 
        
           	doc.Find("input").Each(func(i int, s *goquery.Selection) { 
        
           		attrName, ok := s.Attr("name") 
        
           		if !ok { 
        
           			return 
        
           		} 
        
           		if attrName == "ctx" { 
        
           			ctx, _ = s.Attr("value") 
        
           		} 
        
           		if attrName == "flowtoken" { 
        
           			flowToken, _ = s.Attr("value") 
        
           		} 
        
           	})

Not sure what's happening here, saml2aws tries to find a form in this document?

<!DOCTYPE html>
<html>

<head>
    <base href=\"/start\" />
    <title>Your applications</title>
    <link href=\"https://d250zetdqyq0c4.cloudfront.net/assets/Prod/eu-west-1/007be21c04ea87207820a84317c029b6/main.css\"
        rel=\"stylesheet\">
    <link rel=\"shortcut icon\"
        href=\"https://d250zetdqyq0c4.cloudfront.net/assets/Prod/eu-west-1/007be21c04ea87207820a84317c029b6/favicon.ico\">
    <meta charset=\"UTF-8\">
    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />
    <meta name=\"region\" content=\"eu-west-1\" />
    <meta name=\"stage\" content=\"Prod\" />
</head>

<body>
    <app></app>
    <script type=\"application/javascript\"
        src=\"https://d250zetdqyq0c4.cloudfront.net/assets/Prod/eu-west-1/007be21c04ea87207820a84317c029b6/polyfills.js\"></script>
    <script type=\"application/javascript\"
        src=\"https://d250zetdqyq0c4.cloudfront.net/assets/Prod/eu-west-1/007be21c04ea87207820a84317c029b6/vendor.js\"></script>
    <script type=\"application/javascript\"
        src=\"https://d250zetdqyq0c4.cloudfront.net/assets/Prod/eu-west-1/007be21c04ea87207820a84317c029b6/main.js\"></script>
</body>

</html>

Looking through the page in the browser there's no form as far as I can see. The <app></app> tags do however have content in it when in the browser.

missingcharacter · 2021-06-30T02:05:26Z

@eliasericsson could you please try my patch and let me know if it works for you #684 ?

missingcharacter · 2021-07-02T19:15:47Z

Hi @eliasericsson , have you had a chance to try my patched version #684 ?

eliasericsson · 2021-07-05T08:41:16Z

Tested it and commented on the PR Thanks, Elias

…

2 juli 2021 kl. 21:15 skrev Ricardo Rosales ***@***.***>: Hi @eliasericsson , have you had a chance to try my patched version #684 ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

missingcharacter · 2021-07-07T14:55:04Z

@eliasericsson can this be closed now that awscli SSO worked?

eliasericsson · 2021-07-08T14:19:41Z

For my personal use case this is no longer an issue. Den ons 7 juli 2021 kl 16:55 skrev Ricardo Rosales ***@***.***

…

: @eliasericsson <https://github.com/eliasericsson> can this be closed now that awscli SSO worked? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#628 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOVUAZD3O3C5YXGO3UTZNDTWRTFHANCNFSM4Y2BUTQQ> .

mifitous · 2021-07-19T09:30:54Z

@eliasericsson : it still doesn't work for me
here's my config:
account {
AppID: cb7ac32d-cdab-4986-89ce-0c93ce122a47
URL: https://account.activedirectory.windowsazure.com
Username: michael.fi@bw-robotics.com
Provider: AzureAD
MFA: Auto
SkipVerify: false
AmazonWebservicesURN: urn:amazon:webservices
SessionDuration: 3600
Profile: default
RoleARN:
Region: us-east-1
}
I'm using "AWS Single Sign-on" Microsoft Application
Any idea please?

saml2aws --version
2.31.0

logs:
saml2aws login --verbose
DEBU[0000] Running command=login
DEBU[0000] check if Creds Exist command=login
DEBU[0000] Expand name=/Users/michael/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink name=/Users/michael/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists filename=/Users/michael/.aws/credentials pkg=awsconfig
Using IDP Account default to access AzureAD https://account.activedirectory.windowsazure.com
DEBU[0000] Get credentials helper=osxkeychain serverURL="https://account.activedirectory.windowsazure.com"
DEBU[0000] Get credentials helper=osxkeychain user=michael.fi@bw-robotics.com
To use saved password just hit enter.
? Username
? Password

DEBU[0000] building provider command=login idpAccount="account {\n AppID: cb7ac32d-cdab-4986-89ce-0c93ce122a47\n URL: https://account.activedirectory.windowsazure.com\n Username: michael.fi@bw-robotics.com\n Provider: AzureAD\n MFA: Auto\n SkipVerify: false\n AmazonWebservicesURN: urn:amazon:webservices\n SessionDuration: 3600\n Profile: default\n RoleARN: \n Region: us-east-1\n}"
Authenticating as michael.fi@bw-robotics.com ...
DEBU[0002] HTTP Req URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0002] HTTP Res Status="200 OK" http=client
DEBU[0002] HTTP Req URL="https://login.microsoftonline.com/kmsi" http=client method=POST
DEBU[0002] HTTP Res Status="200 OK" http=client
DEBU[0002] HTTP Req URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
DEBU[0003] HTTP Res Status="200 OK" http=client
unable to locate SAMLRequest URL
error authenticating to IdP
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:187
runtime.main
runtime/proc.go:225
runtime.goexit
runtime/asm_arm64.s:1130

missingcharacter · 2021-07-19T11:33:55Z

@mifitous this should work for you #684 (comment)

caal-15 · 2021-07-19T15:45:50Z

I'm still running into this issue:

DEBU[0000] Running                                       command=login
DEBU[0000] check if Creds Exist                          command=login
DEBU[0000] Expand                                        name=/home/----/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink                                name=/home/----/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists                            filename=/home/----/.aws/credentials pkg=awsconfig
Using IDP Account default to access AzureAD https://account.activedirectory.windowsazure.com
To use saved password just hit enter.
? Username
? Password *********************

DEBU[0008] building provider                             command=login idpAccount="account {\n  AppID: ----\n  URL: https://account.activedirectory.windowsazure.com\n  Username: ----\n  Provider: AzureAD\n  MFA: Auto\n  SkipVerify: false\n  AmazonWebservicesURN: urn:amazon:webservices\n  SessionDuration: 43200\n  Profile: default\n  RoleARN: \n  Region: us-east-1\n}"
Authenticating as ---- ...
DEBU[0012] HTTP Req                                      URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0013] HTTP Res                                      Status="200 OK" http=client
DEBU[0013] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/BeginAuth" http=client method=POST
DEBU[0013] HTTP Res                                      Status="200 OK" http=client
Phone approval required.
DEBU[0013] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0014] HTTP Res                                      Status="200 OK" http=client
DEBU[0015] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0015] HTTP Res                                      Status="200 OK" http=client
DEBU[0016] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0017] HTTP Res                                      Status="200 OK" http=client
DEBU[0018] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0018] HTTP Res                                      Status="200 OK" http=client
DEBU[0019] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0019] HTTP Res                                      Status="200 OK" http=client
DEBU[0020] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0020] HTTP Res                                      Status="200 OK" http=client
DEBU[0021] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0022] HTTP Res                                      Status="200 OK" http=client
DEBU[0023] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
unable to locate IDP oidc form submit URL
error authenticating to IdP
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
        github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
        command-line-arguments/main.go:187
runtime.main
        runtime/proc.go:225
runtime.goexit
        runtime/asm_amd64.s:1371

caal-15 · 2021-07-19T16:05:07Z

Ohh I see I was using a version without your fix merged in :(

missingcharacter · 2021-07-19T16:41:13Z

@caal-15 not quite, since you are using AWS SSO you may need the below:

As far as I know (which is not a lot), you should be able to use awscli without saml2aws according to

https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html
https://docs.aws.amazon.com/singlesignon/latest/userguide/integrating-aws-cli.html
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html

brent-bradbury-stoke-space · 2021-08-17T19:13:05Z

@missingcharacter - i have a use case where saml2aws functioning for AzureAD (idp) and Amazon SSO (sp) would be useful - we have a mixed environment where some AWS accounts use AWS SSO, and other accounts in AWS GovCloud cannot use AWS SSO because it is not supported in GovCloud. There we are using the traditional AWS SAML 2.0 login scheme with AzureAD as the IDP. If saml2aws could support both then we could have a single CLI login experience for users and it would be very helpful!

aflatto · 2023-01-05T11:17:58Z

Hello
I am still encountering this issue with version 2.36.2 and 2.32.0
./saml2aws login --verbose
DEBU[0000] Running command=login
DEBU[0000] check if Creds Exist command=login
DEBU[0000] Expand name=/home/aflatto/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink name=/home/aflatto/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists filename=/home/aflatto/.aws/credentials pkg=awsconfig
Using IDP Account default to access AzureAD https://account.activedirectory.windowsazure.com
To use saved password just hit enter.
? Username
? Password

DEBU[0002] building provider Authenticating DEBU[0004] HTTP Req DEBU[0004] HTTP Res DEBU[0004] HTTP Req DEBU[0005] HTTP Res Phone approval required.
DEBU[0005] HTTP Req DEBU[0005] HTTP Res DEBU[0006] HTTP Req DEBU[0006] HTTP Res DEBU[0007] HTTP Req DEBU[0008] HTTP Res DEBU[0009] HTTP Req DEBU[0022] HTTP Res DEBU[0022] HTTP Req DEBU[0022] HTTP Res DEBU[0022] HTTP Req DEBU[0022] HTTP Res DEBU[0022] HTTP Req DEBU[0024] HTTP Res unable to locate SAMLRequest URL
error authenticating to IdP
github.com/vers github.com/vers main.main
command-line-arguments/main.go:187
runtime.main
runtime/proc.go:225
runtime.goexit
runtime/asm_amd64.s:1371 command=login idpAccount="account {\n AppID: b9364e2e-588b-4b2d-957d-908bd9746332\n URL: https://account.activedirectory.windowsazure.com\n Username: assaff@2bcloud.io\n Provider: AzureAD\n MFA: Auto\n SkipVerify: false\n AmazonWebservicesURN: urn:amazon:webservices\n SessionDuration: 3600\n Profile: saml\n RoleARN: \n Region: \n}"
as assaff@2bcloud.io ...
URL="https://login.microsoftonline.com/common/login" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/BeginAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
Status="200 OK" http=client
URL="https://login.microsoftonline.com/kmsi" http=client method=POST
Status="200 OK" http=client
URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
Status="200 OK" http=client
ent/saml2aws/v2/cmd/saml2aws/commands.Login
ent/saml2aws/v2/cmd/saml2aws/commands/login.go:107

missingcharacter · 2023-01-10T15:33:16Z

@aflatto have you solved this problem?

unlimitedsaml · 2023-02-20T22:16:54Z

I'm getting the same error with 2.36

DEBU[0025] HTTP Res                                      Status="200 OK" http=client
DEBU[0025] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
DEBU[0025] HTTP Res                                      Status="200 OK" http=client
DEBU[0025] HTTP Req                                      URL="https://login.microsoftonline.com/kmsi" http=client method=POST
DEBU[0025] HTTP Res                                      Status="200 OK" http=client
DEBU[0025] HTTP Req                                      URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
DEBU[0029] HTTP Res                                      Status="200 OK" http=client
unable to locate SAMLRequest URL
Error authenticating to IdP.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
	github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:188
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_amd64.s:1594
 ✘ jjj.jjj@jjj-MacBook-Pro  ~  saml2aws --version
2.36.3```

missingcharacter · 2023-02-20T23:21:12Z

@unlimitedsaml and @aflatto

The error : unable to locate SAMLRequest URL seems to come from https://github.com/Versent/saml2aws/blob/v2.36.3/pkg/provider/aad/aad.go#L789-L791

Which means saml2aws was not able to find SAMLRequest in // window.location = 'https:/..../?SAMLRequest=......'

I would start by confirming you actually get SAMLRequest=..... in oidcResponse, err := ioutil.ReadAll(res.Body) in here https://github.com/Versent/saml2aws/blob/v2.36.3/pkg/provider/aad/aad.go#L760-L788

unlimitedsaml · 2023-02-21T17:42:28Z

Sorry I'm not quite sure how to do that. I see I could add print statements into the snippets linked, but I don't find those go files in my local library. I seem to have the executable on my path, which I assume has been pre-built by brew? What would be the mechanism to test? Do I clone git and run from the repo to get the debug statements?

missingcharacter · 2023-02-22T03:33:06Z

@unlimitedsaml

which I assume has been pre-built by brew?

short answer: yes

What would be the mechanism to test? Do I clone git and run from the repo to get the debug statements?

You can start with I see I could add print statements into the snippets linked.

NOTE: Be careful, do not share sensitive information here

NOTE2: Confirm you can actually login to AWS using SAML on a browser, see more details https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/aws-multi-accounts-tutorial#test-sso

keshavrathi01 · 2023-03-27T13:30:16Z

Hi,

I am receiving the same error on version 2.36.5.
After MFA I see the following error:

Error authenticating to IdP.: unable to locate SAMLRequest URL

Installed using brew

missingcharacter · 2023-03-27T15:15:22Z

@keshavrathi01 Could you do what was asked in prior comments?

keshavrathi01 · 2023-03-30T09:08:08Z

Hi,

I had enabled verbose logs and found the following error after 2FA from the app:

DEBU[0016] HTTP Res                                      Status="200 OK" http=client
DEBU[0017] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0017] HTTP Res                                      Status="200 OK" http=client
DEBU[0026] HTTP Res                                      Status="200 OK" http=client
DEBU[0026] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
DEBU[0026] HTTP Res                                      Status="200 OK" http=client
DEBU[0026] HTTP Req                                      URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
DEBU[0027] HTTP Res                                      Status="403 Forbidden" http=client
unable to locate SAMLRequest URL
Error authenticating to IdP.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
	github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:190
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_arm64.s:1172

I am able to access the AWS console and all it's functionalities from the console but not CLI

missingcharacter · 2023-03-30T11:56:02Z

@keshavrathi01 thst looks pretty similar to what @aflatto and @unlimitedsaml shared, could you please read #628 (comment) and start from there

missingcharacter · 2023-03-30T18:14:38Z

@keshavrathi01 also check #628 (comment)

keshavrathi01 · 2023-04-04T07:19:07Z

@missingcharacter How can I verify #628 (comment) ?

I don't see SAMLRequest=..... in the logs. Do I need to download the source and run the source?

Also, today I updated the my saml2aws version and now I see the following error:

DEBU[0006] processing ConvergedSignIn                    provider=AzureAD
DEBU[0006] HTTP Req                                      URL="https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US" http=client method=POST
DEBU[0007] HTTP Res                                      Status="200 OK" http=client
DEBU[0007] HTTP Req                                      URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
DEBU[0008] processing a 'hiddenform'                     provider=AzureAD
DEBU[0008] HTTP Req                                      URL="https://login.microsoftonline.com:443/common/DeviceAuthTls/reprocess" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
DEBU[0008] processing ConvergedTFA                       provider=AzureAD
DEBU[0008] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/BeginAuth" http=client method=POST
DEBU[0009] HTTP Res                                      Status="200 OK" http=client
Phone approval required. Entropy is: 92
DEBU[0009] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0009] HTTP Res                                      Status="200 OK" http=client
DEBU[0010] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0011] HTTP Res                                      Status="200 OK" http=client
DEBU[0012] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0012] HTTP Res                                      Status="200 OK" http=client
DEBU[0013] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0014] HTTP Res                                      Status="200 OK" http=client
DEBU[0015] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0015] HTTP Res                                      Status="200 OK" http=client
DEBU[0016] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0016] HTTP Res                                      Status="200 OK" http=client
DEBU[0016] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
DEBU[0017] HTTP Res                                      Status="200 OK" http=client
DEBU[0017] processing a 'hiddenform'                     provider=AzureAD
DEBU[0017] HTTP Req                                      URL="https://account.activedirectory.windowsazure.com/" http=client method=POST
DEBU[0017] HTTP Res                                      Status="403 Forbidden" http=client
DEBU[0017] reached an unknown page within the authentication process  provider=AzureAD
failed get SAMLAssertion
github.com/versent/saml2aws/v2/pkg/provider/aad.(*Client).Authenticate
	github.com/versent/saml2aws/v2/pkg/provider/aad/aad.go:222
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:105
main.main
	github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:190
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_arm64.s:1172
Error authenticating to IdP.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
	github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:190
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_arm64.s:1172

missingcharacter · 2023-04-04T11:40:57Z

@keshavrathi01 yes, you'd need the source code

MagnusHJensen · 2023-06-29T06:52:34Z

A colleague of mine saw this issue on 2.36.0, but when upgrading to 2.36.9 it was fixed.

project-administrator · 2023-07-04T12:27:18Z

For me it looks like it's missing some of the last redirects, because if I'm using the browser it would do few more redirects after the https://mycompany-onmicrosoft-com.access.mcas.ms/aad_login and eventually succeed..
Here is the full log:

$ saml2aws login --verbose --force
DEBU[0000] Running                                       command=login
DEBU[0000] Check if creds exist.                         command=login
DEBU[0000] Expand                                        name=/home/a1/.aws/credentials pkg=awsconfig
DEBU[0000] resolveSymlink                                name=/home/a1/.aws/credentials pkg=awsconfig
DEBU[0000] ensureConfigExists                            filename=/home/a1/.aws/credentials pkg=awsconfig
Using IdP Account default to access AzureAD https://account.activedirectory.windowsazure.com/applications/signin/12345678-1234-5678-90ab-1234567890ab?tenantId=87654321-4321-8765-beef-ba0987654321
To use saved password just hit enter.
? Username me@mycompany.com
? Password ************

DEBU[0006] building provider                             command=login idpAccount="account {\n  AppID: 12345678-1234-5678-90ab-1234567890ab\n  URL: https://account.activedirectory.windowsazure.com/applications/signin/12345678-1234-5678-90ab-1234567890ab?tenantId=87654321-4321-8765-beef-ba0987654321\n  Username: me@mycompany.com\n  Provider: AzureAD\n  MFA: Auto\n  SkipVerify: false\n  AmazonWebservicesURN: urn:amazon:webservices\n  SessionDuration: 3600\n  Profile: saml\n  RoleARN: \n  Region: \n}"
Authenticating as me@mycompany.com ...
DEBU[0007] processing ConvergedSignIn                    provider=AzureAD
DEBU[0007] HTTP Req                                      URL="https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US" http=client method=POST
DEBU[0007] HTTP Res                                      Status="200 OK" http=client
DEBU[0007] HTTP Req                                      URL="https://login.microsoftonline.com/common/login" http=client method=POST
DEBU[0007] HTTP Res                                      Status="200 OK" http=client
DEBU[0007] processing ConvergedTFA                       provider=AzureAD
DEBU[0007] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/BeginAuth" http=client method=POST
DEBU[0008] HTTP Res                                      Status="200 OK" http=client
? Enter verification code 430703
DEBU[0013] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/EndAuth" http=client method=POST
DEBU[0013] HTTP Res                                      Status="200 OK" http=client
DEBU[0013] HTTP Req                                      URL="https://login.microsoftonline.com/common/SAS/ProcessAuth" http=client method=POST
DEBU[0013] HTTP Res                                      Status="200 OK" http=client
DEBU[0013] processing a 'hiddenform'                     provider=AzureAD
DEBU[0013] HTTP Req                                      URL="https://mycompany-onmicrosoft-com.access.mcas.ms/aad_login" http=client method=POST
DEBU[0014] HTTP Res                                      Status="200 OK" http=client
DEBU[0014] reached an unknown page within the authentication process  provider=AzureAD
failed get SAMLAssertion
github.com/versent/saml2aws/v2/pkg/provider/aad.(*Client).Authenticate
	github.com/versent/saml2aws/v2/pkg/provider/aad/aad.go:222
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:105
main.main
	./main.go:191
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_amd64.s:1598
Error authenticating to IdP.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
	github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:107
main.main
	./main.go:191
runtime.main
	runtime/proc.go:250
runtime.goexit
	runtime/asm_amd64.s:1598

For comparison, here is the browser version of the same auth with saml2aws:

This was referenced Jun 18, 2021

[Azure AD]Fix Azure AD login with conditional access #681

Merged

AzureAD: unable to locate IDP oidc form submit URL #645

Open

missingcharacter mentioned this issue Jun 30, 2021

[aad] Adding support for conditional MFA #684

Merged

wolfeidau closed this as completed in #684 Jul 17, 2021

jf13 mentioned this issue Feb 20, 2024

AzureAD: reached an unknown page within the authentication process #1219

Open

AzureAD: unable to locate SAMLRequest URL, error authenticating to IdP #628

AzureAD: unable to locate SAMLRequest URL, error authenticating to IdP #628

Comments

eliasericsson commented Mar 8, 2021

Csmithson-qh commented Mar 9, 2021

MinsonTFW commented Mar 18, 2021

eliasericsson commented Mar 22, 2021

lincheney commented May 3, 2021

rprieto commented Jun 10, 2021

eliasericsson commented Jun 14, 2021

eliasericsson commented Jun 14, 2021

rprieto commented Jun 14, 2021

eliasericsson commented Jun 14, 2021

eliasericsson commented Jun 24, 2021

missingcharacter commented Jun 30, 2021

missingcharacter commented Jul 2, 2021

eliasericsson commented Jul 5, 2021 via email

missingcharacter commented Jul 7, 2021

eliasericsson commented Jul 8, 2021 via email

mifitous commented Jul 19, 2021 • edited Loading

missingcharacter commented Jul 19, 2021

caal-15 commented Jul 19, 2021 • edited Loading

caal-15 commented Jul 19, 2021

missingcharacter commented Jul 19, 2021

brent-bradbury-stoke-space commented Aug 17, 2021

aflatto commented Jan 5, 2023

missingcharacter commented Jan 10, 2023

unlimitedsaml commented Feb 20, 2023

missingcharacter commented Feb 20, 2023 • edited Loading

unlimitedsaml commented Feb 21, 2023

missingcharacter commented Feb 22, 2023

keshavrathi01 commented Mar 27, 2023 • edited Loading

missingcharacter commented Mar 27, 2023

keshavrathi01 commented Mar 30, 2023 • edited Loading

missingcharacter commented Mar 30, 2023

missingcharacter commented Mar 30, 2023

keshavrathi01 commented Apr 4, 2023

missingcharacter commented Apr 4, 2023

MagnusHJensen commented Jun 29, 2023

project-administrator commented Jul 4, 2023

mifitous commented Jul 19, 2021 •

edited

Loading

caal-15 commented Jul 19, 2021 •

edited

Loading

missingcharacter commented Feb 20, 2023 •

edited

Loading

keshavrathi01 commented Mar 27, 2023 •

edited

Loading

keshavrathi01 commented Mar 30, 2023 •

edited

Loading