I recently followed these instructions to set up SAML for AmazonWorkspaces. The result: a loop between 'Open Workspaces' and the IdP auth (which seems to be working fine). I looked at the URL details, and noticed that AWS (acting as SP) provides an SP response containing three URLs:
- The IdP SSO URL (presumably taken from the metadata.
- The relaystate URL created per the instructions.
- A token (saml/start/TOKEN) to start the workspace.
When I copy/paste the third URL into the browser, it does successfully open the workspace login screen. This makes me think that the SP response needs to be edited so that only the third URL is provided. Any ideas how to do this?
I'm thinking the IdP metadata (I'm using Okta btw) needs to be edited somehow, though I'm open to other suggestions as well.
Did you ever find a solution? I am also getting the same loop.