Federated User Authentication issue

0

I have a user that is showing up in IAM Identity Center. The person has a group, permission set and a URL to login. I re-setup the users MFA with the user in a screen share.

When the login they put in their username, password then MFA token. The web page spins a bit then forwards them back to the login screen. NO ERRORS.

In cloudtrail I found the following for the user: UserAuthentication - Status of Success CredentialVerification - Status of Success Authenticate - Status of ????

In the Authenicate event I do not see any Success or Failure. At the top of the screen is showed Error Code - . What is an error code of DASH? Why can this user not login?

asked 2 months ago78 views
1 Answer
1

Hello,

I understand that IAM Identity Center user is not able to login as after entering the login information and MFA user is being redirected back to login screen.

To answer your question, we will require details about your set-up that are non-public information. So, I would request you to please open a support case with AWS using the following link:

https://console.aws.amazon.com/support/home#/case/create

Coming to your second query for "Error Code -" which is shown in the Authenticate API call, I would like to inform you that if any API is executed without error you will see the ErrorCode as '-' in the CloudTrail console and no key for "errorCode" will be present in the event Json.

[+] Error code and message log example: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-examples.html#error-code-and-error-message

You are able to see the "Success" message in the "serviceEventDetails" key for the UserAuthentication and CredentialVerification. serviceEventDetails identifies the service event, including what triggered the event and the result. This is an optional key. These events are created by AWS services but are not directly triggered by a request to a public AWS API.

Refer below link for more details on this:

[+] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/non-api-aws-service-events.html

Thank you!

AWS
SUPPORT ENGINEER
answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions