-
Notifications
You must be signed in to change notification settings - Fork 606
Description
Issue Summary
Command saml2aws login fails if a user only has one AWS role to select.
Details
Encountered with my workplace SSO, so I'm not 100% confident in reproducibility for other folks (not sure if it's AWS's behavior described below happens for everyone).
If you only have one role to select after finishing SSO to aws, it skips the intermediate page that lists roles and accounts. saml2aws depends on this page loading, because it does html parsing on the page to figure out the list of account names.

This is an example of the page loading as expected for a user with multiple selectable roles. saml2aws works fine if this page loads.
If the page is skipped (which AWS is currently doing for our users with only one selectable role) saml2aws fails to find the account name information and it results in a "No accounts available." error.
Stacktrace
No accounts available.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.resolveRole
github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:334
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole
github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:304
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:132
main.main
github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:199
runtime.main
runtime/proc.go:285
runtime.goexit
runtime/asm_arm64.s:1268
Failed to assume role. Please check whether you are permitted to assume the given role for the AWS service.
github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
github.com/versent/saml2aws/v2/cmd/saml2aws/commands/login.go:134
main.main
github.com/versent/saml2aws/v2/cmd/saml2aws/main.go:199
runtime.main
runtime/proc.go:285
runtime.goexit
runtime/asm_arm64.s:1268