First login to AWS IAM Identity center fails

I am running into an odd issue with the AWS IAM identity center. I have been following this guide to setup Zitadel as IdP for the AWS IAM Identity center:
https://zitadel.com/docs/guides/integrate/services/aws-saml

When I am logging into the AWS Identity Center via the identity center login url (https://d-xxxxxxxx.awsapps.com/start), I get redirected to Zitadel, I log in with my user, after the login I am redirected to an AWS IAM Identity Center error page. With a not very helpful error message:

missingInfoErrorHeading
missingInfoErrorText

missingInfoErrorHeading
missingInfoErrorText

Now, the interesting part is:

Just re-opening the login url (https://d-xxxxxxxx.awsapps.com/start) redirects me again but this time successfully logs me in and I am able to to see my AWS accounts and assigned permission sets.

It seems like the initial redirect on a freh login is wrong. Did anyone encounter similar issues?

Here the SAML Metadata file received from AWS, the metadata file is used in the SAML Application in Zitadel

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="https://eu-central-1.signin.aws.amazon.com/platform/saml/d-xxxxxxxxxx">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://eu-central-1.signin.aws.amazon.com/platform/saml/acs/xxxxxxxxxxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx"
            index="0" isDefault="true" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="https://eu-central-1.signin.aws.amazon.com/platform/saml/d-xxxxxxxxxx">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://eu-central-1.signin.aws.amazon.com/platform/saml/acs/xxxxxxxxxxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx"
            index="0" isDefault="true" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

I have attached the SAML IDP configuration in AWS, and the "error message" as screenshots

ZITADEL Docs

This guide shows how to enable login with ZITADEL on AWS SSO.

First login to AWS IAM Identity center fails

missingInfoErrorHeading
missingInfoErrorText

missingInfoErrorHeading
missingInfoErrorText

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="https://eu-central-1.signin.aws.amazon.com/platform/saml/d-xxxxxxxxxx">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://eu-central-1.signin.aws.amazon.com/platform/saml/acs/xxxxxxxxxxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx"
            index="0" isDefault="true" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    entityID="https://eu-central-1.signin.aws.amazon.com/platform/saml/d-xxxxxxxxxx">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"
        protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://eu-central-1.signin.aws.amazon.com/platform/saml/acs/xxxxxxxxxxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx"
            index="0" isDefault="true" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

I have attached the SAML IDP configuration in AWS, and the "error message" as screenshots

ZITADEL Docs

This guide shows how to enable login with ZITADEL on AWS SSO.

First login to AWS IAM Identity center fails

First login to AWS IAM Identity center fails

Continue the conversation

ZITADEL

Continue the conversation

ZITADEL

Similar Threads