External IdP (PingFederate) SAML SSO to IAM Identity Center fails with AUTHENTICATION_FAILED despite valid, correctly-signed assertion

The most likely cause is that the NameID is matched against the "Username," not the "email address."

The official documentation "Using SAML and SCIM identity federation with external identity providers - AWS IAM Identity Center" explicitly states the following:

The SAML assertion's Subject NameID value must exactly match the Username of a user provisioned in IAM Identity Center. Sign-in fails if IAM Identity Center cannot match the NameID to a Username, even when the external IdP authenticates the user successfully.

Furthermore, an AWS Knowledge Center article "Troubleshoot IAM Identity Center SSO login failures | AWS re:Post" states the following:

Verify that the SAML nameID value sent by your IdP exactly matches the case-sensitive username in IAM Identity Center. The match is based on username, not email address.

This may actually differ slightly from what you have verified. You confirmed that the NameID value matches the AWS user's email address exactly (down to the byte level), but IAM Identity Center performs the match against the "Username" field, not the "Email" field.

If the "Username" field for the two test users in IAM Identity Center happens to be set to a value other than the email address (e.g., an employee ID or a "firstname.lastname" format), authentication will fail because the string does not match the target Username—even if the NameID format is set to "emailAddress."

Open the user details screen in IAM Identity Center and verify whether the value in the "Username" field matches the NameID value sent by PingFederate exactly (including case sensitivity); check this separately from the "Email" field. If they do not match, this is highly likely to be the direct cause of the failure.

The AUTHENTICATION_FAILED (often accompanied by the "Looks like this code isn't right" frontend message) in IAM Identity Center is a generic catch-all for SAML validation failures. Since you have already verified the cryptographic trust (signatures, certificates, timing, entity IDs), the issue almost certainly lies in strict data matching or schema validation.

To answer your questions:

1. AttributeStatement & Matching requirements: IAM Identity Center is strictly case-sensitive regarding the NameID. Even if you verified it byte-for-byte, ensure it perfectly matches the Username attribute stored in the AWS Identity Store (not just the contact email field). Furthermore, ensure the assertion is entirely unencrypted (AWS does not support encrypted SAML assertions) and that the <Subject> element properly encapsulates the <NameID>.
2. AuthnContextClassRef: AWS Identity Center generally expects urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport or unspecified. Ensure PingFederate is actively including this element in the assertion, as its complete omission can cause validation to fail.
3. Propagation delay: While the identity source toggle in the console is usually immediate, user assignments and backend state synchronization can take a few minutes. However, if the issue persists beyond 15–30 minutes, it is not a propagation delay.
4. Server-side error visibility: You can get the exact, detailed server-side error by querying AWS CloudTrail. Look for the event name ExternalIdPDirectoryLogin (Event source: sso.amazonaws.com) in the AWS Management account. The errorMessage or responseElements field in the raw JSON record will explicitly state what failed (e.g., "Subject mismatch", "Invalid signature", etc.).

Actionable next step: Check the ExternalIdPDirectoryLogin event in CloudTrail. A very common resolution for this exact symptom with newly created test users is an invisible desync between the IdP and AWS Identity Store. Deleting the manually created user in Identity Center and re-creating it (or letting SCIM provision it) frequently resolves this.

References:

• AWS Documentation - Troubleshooting IAM Identity Center (External IdP sign-in errors): https://docs.aws.amazon.com/singlesignon/latest/userguide/troubleshooting.html
• AWS re:Post - "Looks like this code isn't right" SAML mismatch issue: https://repost.aws/questions/QUiqqAQH1WRTCJjnMiFysUMw/aws-identity-centre-with-azure-ad-looks-like-this-code-isn-t-right