Issue with the auto-provisioning from Google Workspace (IDP) to AWS

Hello,

I've been able to configure AWS SSO with Google Workspace as it's identity provider using this guide - https://aws.amazon.com/fr/blogs/security/how-to-use-g-suite-as-external-identity-provider-aws-sso/ and then I was also able to configure the auto-provisioning using this guide : https://support.google.com/a/answer/13047358?hl=en&sjid=771444752923218931-EU

Some users were added to a new group in Google Workspace and we see the "Create User" events in cloudtrail. These users are properly created on the AWS Identity Center side except for 2 of them. I don't understand what's happening because everything was created as described in the guides.

The error returned for these 2 users is : StatusCode: 400 : Bad Request : { schema :[ urn:ietf:params:scim:api:messages:2.0:Error ]  schemas :[ urn:ietf:params:scim:api:messages:2.0:Error ]  detail : Request is unparsable  syntactically incorrect  or violates schema.   status : 400   exceptionRequestId : e2bda560-b936-41c8-b4c7-b5844c7cc752   timeStamp : 2023-10-04 07:42:28.399 }

So we checked the attributes of all users and they are similar.  There are two attributes per user:

Google directory attribute     -    Amazon Web Services attribute

Basic Information > Primary Email  -> https://aws.amazon.com/SAML/Attributes/RoleSessionName Amazon > Role*  ->  https://aws.amazon.com/SAML/Attributes/Role

And the custom Amazon one is defined like in the guide :

Name: Role Info type: Text Visibility: Visible to user and admin No. of values: Multi-value

Does anyone have an idea?

Thanks in advance!