Secondary AD Domain: Error authenticating to IdP.: failed get SAMLAssertion

[pataraco]

Hello,

We have 3 AD Domains (Directories?), e.g.

• domain1.com ("dev")
• domain2.com ("stg")
• domain3.com ("prd")

I have 2 sets of credentials, e.g.:

1. [email protected]
2. [email protected]

When I log into Azure (portal) with "[email protected]" I can see/switch between the 2 domains/directories: "domain2.com" and "domain3.com"

I can use saml2aws just fine with 2 (dev & prd) out of the 3. However when trying to use saml2aws for our "stg" domain i get this:

bash-⌲ saml2aws login --config=$_SAML_CFG --idp-account=stg [email protected] --password='PASS3' --skip-prompt
Using IdP Account stg to access AzureAD https://account.activedirectory.windowsazure.com
Authenticating as [email protected] ...
Phone approval required. Entropy is: 77
Error authenticating to IdP.: failed get SAMLAssertion

when trying login to "domain2" i get this:

bash-⌲ saml2aws login --config=$_SAML_CFG --idp-account=stg [email protected] --password='PASS2' --skip-prompt
Using IdP Account stg to access AzureAD https://account.activedirectory.windowsazure.com
Authenticating as [email protected] ...
Error authenticating to IdP.: login error 50034

Which I found:

Error 50034 - User does not exist in directory

Here is my .saml2aws config entry (redacted):

[stg]
aws_acct_id             = ************
app_id                  = ********-****-****-****-************
aws_profile             = stg
aws_session_duration    = 14400
aws_urn                 = urn:amazon:webservices
disable_remember_device = false
disable_sessions        = false
mfa                     = Auto
name                    = stg
provider                = AzureAD
region                  = us-west-2
saml_cache              = true
skip_verify             = false
timeout                 = 0
url                     = https://account.activedirectory.windowsazure.com
username                = [email protected]

Does anyone have any ideas how i can get this to work?

Thanks!