[icirellik]

Summary

Microsoft can occasionally ask users to set up an additional sign-in method, with an option to choose Not now. saml2aws currently stops instead of completing that offered path.

This change sends Microsoft the continuation details from that page, allowing the AWS login to finish automatically. Older versions of the prompt remain supported. If Microsoft requires registration and does not offer a skip option, saml2aws still stops as before.

Why this matters

Affected users can be blocked once a day by a setup reminder even though their existing sign-in method is valid. Automating Microsoft's offered Not now action restores command-line workflows without weakening required registration policies.

The flow was validated against a live 50203 registration prompt: it continued through the normal sign-in pages and returned AWS credentials.

Validation

• Added coverage for the current registration continuation request
• Preserved compatibility with the older continuation path
• Confirmed mandatory 502031 registration remains enforced
• Full tests, build, static checks, and race checks pass

Resolves #1540.

[icirellik]

Live validation found an additional gap, so I am moving this back to draft while I correct it. The client now reaches the optional 50203 page, but a plain GET to the advertised skip URL returns ConvergedError rather than completing the browser-equivalent Not now action. I am capturing only redacted request-shape metadata before revising the implementation; mandatory registration behavior remains unchanged.

[icirellik]

Live validation is now complete.

• A plain GET to urlSkipMfaRegistration was rejected by Entra with pgid=ConvergedError.
• Posting the page-provided proof-up state to urlPostRedirect produced ConvergedProofUpRedirect (50203) -> KmsiInterrupt -> hidden SAML forms.
• The same saml2aws command then returned AWS credentials successfully.

The updated tests cover that exact modern form request, the older GET continuation, incomplete/conflicting modern state, and mandatory 502031 registration. No authentication data or tenant identifiers are included here.

[nathanmoorepointing]

Hi, this is ready for review for a week now. Since it fixes a recurring daily blocker for users on Azure AD / Microsoft optional sign-in prompts, could we get this merged into main and included in the next patch release? Thanks

[icirellik]

I know it's not optimal for everyone out there, however, we are getting by in the mean time by running a manually compiled binary that I've shared out in Slack. The build steps are easy enough, the installation is a bit less convenient due to Apple code signing, quarantine, and swapping the brew binary. Read through the commands below if it's something you're considering:

Compile the binary:

cd ~/code/saml2aws

CGO_ENABLED=1 GOOS=darwin GOARCH=arm64 \
  go build -trimpath \
  -ldflags '-s -w -X main.Version=2.36.19-team.1+84e4d24' \
  -o build/team-release/saml2aws-arm64 \
  ./cmd/saml2aws

CGO_ENABLED=1 GOOS=darwin GOARCH=amd64 \
  go build -trimpath \
  -ldflags '-s -w -X main.Version=2.36.19-team.1+84e4d24' \
  -o build/team-release/saml2aws-amd64 \
  ./cmd/saml2aws

lipo -create \
  build/team-release/saml2aws-arm64 \
  build/team-release/saml2aws-amd64 \
  -output build/team-release/saml2aws

codesign --force --sign - build/team-release/saml2aws

codesign --verify --deep --strict build/team-release/saml2aws
lipo -info build/team-release/saml2aws
build/team-release/saml2aws --version

COPYFILE_DISABLE=1 tar -czf \
  build/saml2aws-2.36.19-team.1-84e4d24-darwin-universal.tar.gz \
  -C build/team-release \
  saml2aws README.txt SHA256SUMS

shasum -a 256 \
  build/saml2aws-2.36.19-team.1-84e4d24-darwin-universal.tar.gz

Install the binary:

# Note: Access to this folder may be blocked by system 
# protection, use a different folder if you are seeing issues.
cd ~/Downloads
archive="saml2aws-2.36.19-team.1-84e4d24-darwin-universal.tar.gz"

# Your SHA may be different
echo "c1542fca3bab1fa2fb78c389eac68dc4b83c1893933d215567a0d80b29c5de5e  $archive" |
  shasum -a 256 -c -

mkdir -p saml2aws-team
tar -xzf "$archive" -C saml2aws-team
cd saml2aws-team

shasum -a 256 -c SHA256SUMS
xattr -d com.apple.quarantine saml2aws 2>/dev/null || true
chmod +x saml2aws

dest="$(brew --prefix)/bin/saml2aws"
cp -p "$dest" "$dest.backup.$(date +%Y%m%d%H%M%S)"
cp saml2aws "$dest"
hash -r

saml2aws --version

[mvillafuertem]

Hi @icirellik, any update? when will be this merged?

[DiegoMontilla5]

Confirmed working on Windows (Azure AD provider, Authenticator number matching). Released 2.36.19 failed every time with login error 50203; this branch logs in successfully.

Side note for Windows users: the PR build then hit Error storing password in keychain.: The stub received bad data. Adding --disable-keychain works around it.

Would be great to get this into a patch release. Thanks @icirellik for the fix!

[hegyre]

Hello @icirellik, @DiegoMontilla5,
Can you please share the Windows / linux / mac binaries fix version somewhere please? me and my team also falls into this issue.

[rugginic]

Hi @tinaboyce @srizzling, could one of you take a look at this PR?

Without it, v2.36.19 fails with login error 50203 at every fresh login for Azure AD tenants where Microsoft shows its optional "set up another sign-in method" prompt, so affected users can't get AWS CLI credentials. Re-registering Authenticator only clears it until the session expires. #1540 has at least 7 thumbs-up reactions, and four other users have commented here asking for a merge or binaries, or confirming the fix.

We're running a build of 16ef703 internally and it fixes the login. A merge and a tagged release would let everyone else drop their workarounds. Thanks!

[srizzling]

@pwmcintyre - Can you help here?

[DiegoMontilla5]

Hello @icirellik, @DiegoMontilla5, Can you please share the Windows / linux / mac binaries fix version somewhere please? me and my team also falls into this issue.

@hegyre , hey, I'd rather not pass around binaries for a tool that handles credentials (and you probably shouldn't run one from a stranger either), but building it from this PR only takes a few minutes. Here's exactly what I did:

1. Install Go and Git if you don't have them:

• Windows: winget install GoLang.Go and winget install Git.Git, then open a new terminal
• Mac: brew install go git
• Linux: your package manager, or https://go.dev/dl/

Check with go version and git --version.

2. Clone the repo and pull this PR's code. GitHub exposes every PR as a branch you can fetch by number:

git clone https://github.com/Versent/saml2aws
cd saml2aws
git fetch origin pull/1541/head:pr1541
git checkout pr1541

The fetch line downloads the PR's changes into a local branch called pr1541, and checkout switches to it.

3. Build it:

go build -o saml2aws-pr ./cmd/saml2aws

(On Windows use -o saml2aws-pr.exe.)

4. Log in with the new binary from that same folder. It uses your existing ~/.saml2aws config:

./saml2aws-pr login --idp-account <your-account> --force

(On Windows: .\saml2aws-pr.exe login ...)

Windows note: after MFA I got Error storing password in keychain.: The stub received bad data. Adding --disable-keychain fixes it.

Once this gets merged and released, just upgrade your normal install and delete the PR build. A 👍 on the PR may help it get merged sooner.

[jkamleh]

Hello @icirellik, @DiegoMontilla5, Can you please share the Windows / linux / mac binaries fix version somewhere please? me and my team also falls into this issue.

Temporary fork until this is merged: jkamleh/saml2aws v2.36.19-team.1

It combines this PR with #1516, so Windows users don't need the --disable-keychain workaround. Both PRs are merged as is, with no changes to their code. On top of them:

• Toolchain bumped to Go 1.27.2. Only the toolchain line changed; go 1.21.0 is the same, so language semantics are unchanged. This matches the builds I tested locally on macOS and Windows. Go 1.25 and later is also why Bump wincred from v1.2.2 to v1.2.3 #1516 is needed: wincred 1.2.2 fails on Windows with The stub received bad data. when built with newer Go.
• Release workflow trimmed for the fork. I removed the Chocolatey and Docker publishing. Workflows only run when dispatched manually.
• README has install steps for macOS, Windows and Linux.

Binaries are built by GitHub Actions on the fork and published with checksums. You can see the commits and build runs from the release page. They aren't signed or notarised, so you'll still need to unquarantine them on macOS or unblock them on Windows; the README covers both.

[rugginic]

Hi @tinaboyce @srizzling, any updates here? People are using forks and workarounds because this PR is not being merged. Is this project dead?

[oussemabhouri]

@tinaboyce @srizzling Could you please review this and merge it? People are stuck.

[srizzling]

I don't work at versent anymore I don't have the rights to merge.

[jkamleh]

I don't work at versent anymore I don't have the rights to merge.

@srizzling do you have any contacts there? Could you reach out to them?