OneLogin - AWS Multi-role Error: AccessDenied for sts:AssumeRoleWithSAML (4383248)

When using OneLogin Amazon Web Services (AWS) Multi-Account roles, users may encounter an authorization error when attempting to assume a role.

This issue may occur after adding a SAML attribute such as:

https://aws.amazon.com/SAML/Attributes/PrincipalTag:Username

This issue is typically caused by one or more of the following:

• The AWS IAM role trust relationship does not properly allow SAML-based role assumption.
• The configuration contains case-sensitive mismatches in SAML attributes or keys.
• Differences exist between working and non-working environments (e.g., staging vs production).
• Required AWS SAML attributes are missing or incorrectly defined.

Important:
AWS SAML configuration is strictly case-sensitive, including protocol values and attribute names. Even small differences (e.g., Http vs http) can result in authorization failures. 

Follow these steps to resolve the issue:

1. Verify AWS Role Trust Relationship

• Open the affected IAM role in AWS.
• Review the Trust Relationship policy.
• Ensure it includes permission for:

  sts:AssumeRoleWithSAML
  

• Confirm the correct SAML provider is referenced.

2. Validate SAML Configuration in AWS

• Ensure the AWS SAML provider is properly configured.
• Check that all required SAML attributes are allowed and correctly defined.

3. Compare Working vs Non-Working Environments

• If the issue does not occur in another environment:
  • Compare IAM roles
  • Compare SAML configurations
  • Identify any differences in attribute mappings or trust policies

4. Check Case Sensitivity

• Verify that all SAML attribute names and values match exactly:
  • Attribute keys
  • URLs
  • Protocol values (https, http, etc.)
• Ensure there are no capitalization inconsistencies.

5. Confirm OneLogin Configuration

• In OneLogin, verify the AWS Multi-Account app configuration:
  • Required AWS SAML attributes are present
  • Attribute names match AWS expectations exactly
  • The attribute is correctly set to "Include in SAML assertion"

6. Retest

• Save all configuration changes.
• Attempt role assumption again to confirm resolution.