From 8fe9637e6602462d4bcf3610dc05b242b11df226 Mon Sep 17 00:00:00 2001 From: Ali Ardestani Date: Mon, 1 Jun 2026 22:23:10 -0700 Subject: [PATCH] fix(login): skip ParseAWSAccounts when RoleARN is configured When a RoleARN is set in the IdP account, the role and principal ARNs are already populated by ParseAWSRoles from the SAML assertion, so the HTTP POST to the AWS signin endpoint inside ParseAWSAccounts is purely used to fetch human-readable account names for the interactive picker. With a configured RoleARN the picker is never shown, making that round-trip unnecessary. It is also actively broken for some AWS sign-in flows. AWS's commercial endpoint (signin.aws.amazon.com/saml) now responds to some SAML POSTs with a JavaScript "hashArgs" interstitial page instead of the legacy "fieldset > div.saml-account" HTML that ExtractAWSAccounts scrapes. ExtractAWSAccounts then returns an empty slice and resolveRole errors with "No accounts available." even though the SAML assertion is valid and contains the configured role. Move the RoleARN short-circuit ahead of the ParseAWSAccounts step so that any RoleARN-configured account skips it. The interactive multi-role picker path (no RoleARN, multiple roles in the assertion) is unchanged. --- cmd/saml2aws/commands/login.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/cmd/saml2aws/commands/login.go b/cmd/saml2aws/commands/login.go index 986c42e2b..ca22b0a8e 100644 --- a/cmd/saml2aws/commands/login.go +++ b/cmd/saml2aws/commands/login.go @@ -311,13 +311,14 @@ func selectAwsRole(samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWS func resolveRole(awsRoles []*saml2aws.AWSRole, samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWSRole, error) { var role = new(saml2aws.AWSRole) + if len(awsRoles) == 0 { + return nil, errors.New("No roles available.") + } + if account.RoleARN != "" { + return saml2aws.LocateRole(awsRoles, account.RoleARN) + } if len(awsRoles) == 1 { - if account.RoleARN != "" { - return saml2aws.LocateRole(awsRoles, account.RoleARN) - } return awsRoles[0], nil - } else if len(awsRoles) == 0 { - return nil, errors.New("No roles available.") } samlAssertionData, err := b64.StdEncoding.DecodeString(samlAssertion)