aws-adfs
aws-adfs copied to clipboard
Recent Change in Azure MFA Server Authentication uses incorrrect authMethod value
Authentication has recently stopped working after working previously about 3-6 months ago.
Password:
2020-07-24 23:40:31,096 [authenticator authenticator.py:authenticate] [3061-MainProcess] [4770835904-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
This account does not have access to any roles
in authenticator.py, the following check is performed:
def _is_azure_mfa_authentication(html_response):
auth_method = './/input[@id="authMethod"]'
element = html_response.find(auth_method)
return (
element is not None
and element.get('value') == 'AzureMfaServerAuthentication'
)
but my html_response has 'AzureMfaServerAuthentication2020' as the authMethod
<!-- These inputs are required by the presentation framework. Do not modify or remove -->
<input id="authMethod" type="hidden" name="AuthMethod" value="AzureMfaServerAuthentication2020"/>
<input id="context" type="hidden" name="Context" value="<EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns="http://www.w3.org/2001/04/xmlenc#"><EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" /><KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><
Manually changing 'AzureMfaServerAuthentication' to 'AzureMfaServerAuthentication2020' resolves the issue for me. The following also works:
def _is_azure_mfa_authentication(html_response):
auth_method = './/input[@id="authMethod"]'
element = html_response.find(auth_method)
return (
element is not None
and element.get('value').startswith('AzureMfaServerAuthentication')
)
193c193
< and element.get('value') == 'AzureMfaServerAuthentication'
---
> and element.get('value').startswith('AzureMfaServerAuthentication')