400 Bad Request when getting credentials about clisso

[johananl]

Hi @MartinHignett,

I'm assuming clisso version gives you 0.5.0.

This error means that Clisso has sent the OneLogin API a request in a format OneLogin did not expect, or with a wrong / missing field. Could you share some information on how you've configured the OneLogin <> AWS integration? If you've used a OneLogin guide and you can share a link - that would be great (maybe this or this?). If not - the following could help:

• Are you using single-role or multi-role OneLogin configuration?
• When loggin in to AWS using the OneLogin UI, are you prompted to choose a role or redirected to the AWS console immediately?
• Do you have MFA enabled on OneLogin?

OneLogin has lots of configuration options and not all configurations are currently supported by Clisso. It is likely that you are using some feature we aren't and therefore the error. If you could help us understand your use case, perhaps we can add support for it.

Lastly, I would double-check the OneLogin API credentials - maybe they are switched (i.e. secret is used instead of ID and vice versa), disabled on OneLogin or simply wrong?

Thanks,
Johannes

[MartinHignett]

HI @johananl,

You were right - I had client id and secret the wrong way around. However, I am still having trouble:

Could not get temporary credentials: assuming role: InvalidIdentityToken: Invalid base64 SAMLResponse (Service: AWSOpenIdDiscoveryService; Status Code: 400; Error Code: AuthSamlInvalidSamlResponseException; Request ID: d10b4ba6-cbce-11e8-9c73-49107522b9ab)
status code: 400, request id: d10a3aef-cbce-11e8-a5a5-73975708b5b0

I have MFA enabled (though it would be nice to not require that), and I seem to be authenticating correctly with OneLogin, but the response from AWS is not what clisso expected.

My configuration looks like this (redacted, of course)

apps:
dev-resources:
app-id: "<app_id>"
principal-arn: <arn_of_identity_provider>
provider: onelogin
role-arn: arn:aws:iam::<arn_of_SSO_role>
providers:
onelogin:
client-id:
client-secret:
region: US
subdomain: <our_sub_domain>
type: onelogin
username: <my_user_name>

Many thanks for responding so quickly!

Martin

@MartinHignett Looking at the error it looks like the following might help: https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html#troubleshoot_saml_missing-rolesessionname

@MartinHignett Was the issue fixed?

Will close in about 30 days if there is no activity.