Microsoft broke authentication with multiple roles

[sydorovdmytro]

Hello people,

Since April 16 we have been facing a wired behavior of Microsoft that injects the .mcas.ms domain into the SAML URL: https://signin.aws.amazon.com.mcas.ms/saml?cas_app_landing_mgc=%7B%22sle%22%3Afalse%2C%22pt%22%3A0%7D

https://learn.microsoft.com/en-us/defender-cloud-apps/troubleshooting-proxy-url

The app can see the role selection page (see the screenshot) but we can't finish the authentication and fail with Unable to recognize page state! A screenshot has been dumped to aws-azure-login-unrecognized-state.png. If this problem persists, try running with --mode=gui or --mode=debug

The aws-azure-login-unrecognized-state.png file:

Is there any plan to handle this behavior too?

[morko]

I have made a bit of a spaghetti code fix in my fork if it is any help for you:

main...morko:aws-azure-login:main