Skip to content

SAML not working with MFA in Okta Identity Engine #73

@andy-mehta

Description

@andy-mehta

Using the new Okta identity engine, I set my ~/.aws/config file with a profile

[profile trial]
region             = us-gov-west-1
credential_process = aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200

then I ran

aws-okta-processor authenticate --user first.last@company.com --organization trial-1234567.okta.com --application https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272 --region us-gov-west-1 --duration 43200

which resulted in

Password: 
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
Creating new Okta session.
Password: 
Info: Calling https://trial-1234567.okta.com/api/v1/authn
Info: Calling https://trial-1234567.okta.com/api/v1/sessions
Info: Calling https://trial-1234567.okta.com/home/amazon_aws/StringyBits/272
SAMLResponse tag not found due to MFA challenge.
ERROR: SAMLResponse tag was not found!

Also ran the above command appending --factor push:okta and --factor token:software:totp:okta which yielded the same error.

It seems aws-okta-processor may not function properly with the Okta Identity Engine. Can this be fixed for a future release?
Thank you.

(customer sensitive info removed)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions