aws-adfs icon indicating copy to clipboard operation
aws-adfs copied to clipboard

Recent Change in Azure MFA Server Authentication uses incorrrect authMethod value

Open 814HiManny opened this issue 4 years ago • 0 comments

Authentication has recently stopped working after working previously about 3-6 months ago.

Password:
2020-07-24 23:40:31,096 [authenticator authenticator.py:authenticate] [3061-MainProcess] [4770835904-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
This account does not have access to any roles

in authenticator.py, the following check is performed:

def _is_azure_mfa_authentication(html_response):
    auth_method = './/input[@id="authMethod"]'
    element = html_response.find(auth_method)
    return (
        element is not None
        and element.get('value') == 'AzureMfaServerAuthentication'
    )

but my html_response has 'AzureMfaServerAuthentication2020' as the authMethod

            <!-- These inputs are required by the presentation framework.  Do not modify or remove -->
            <input id="authMethod" type="hidden" name="AuthMethod" value="AzureMfaServerAuthentication2020"/>
            <input id="context" type="hidden" name="Context" value="&lt;EncryptedData Type=&quot;http://www.w3.org/2001/04/xmlenc#Content&quot; xmlns=&quot;http://www.w3.org/2001/04/xmlenc#&quot;&gt;&lt;EncryptionMethod Algorithm=&quot;http://www.w3.org/2001/04/xmlenc#aes256-cbc&quot; /&gt;&lt;KeyInfo xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;&lt;

Manually changing 'AzureMfaServerAuthentication' to 'AzureMfaServerAuthentication2020' resolves the issue for me. The following also works:

def _is_azure_mfa_authentication(html_response):
    auth_method = './/input[@id="authMethod"]'
    element = html_response.find(auth_method)
    return (
        element is not None
        and element.get('value').startswith('AzureMfaServerAuthentication')
    )
193c193
<         and element.get('value') == 'AzureMfaServerAuthentication'
---
>         and element.get('value').startswith('AzureMfaServerAuthentication')

814HiManny avatar Jul 25 '20 07:07 814HiManny