400 Client Error: Bad Request for url:

[sayeedhussain]

400 Client Error: Bad Request for url:

[sayeedhussain]

Hi @jggatter Yes I added print stmt to this file

/opt/homebrew/Cellar/gimme-aws-creds/2.8.2_1/libexec/lib/python3.12/site-packages/gimme_aws_creds/okta_identity_engine.py

[epierce]

Are you using --force-classic or the browser-based login? What Global Session Policy and Authentication Policy is applied to the clientID that gimme-aws-creds is using and to the AWS app you're trying to access?

[sayeedhussain]

force_classic = False
open_browser = True%

What Global Session Policy and Authentication Policy is applied to the clientID that gimme-aws-creds is using

• Not Sure

and to the AWS app you're trying to access

• Is this relevant given I am failing to acquire the credentials itself before I can try accessing any app.

~/.okta_aws_login_config contents is as below

okta_org_url = *******
okta_auth_server =
client_id = *******
gimme_creds_server = appurl
aws_appname =
aws_rolename =
write_aws_creds = True
cred_profile = role
okta_username = *******
app_url = *******
resolve_aws_alias = False
include_path = False
preferred_mfa_type = push
remember_device = True
aws_default_duration = 3600
device_token =
output_format = json
force_classic = False
open_browser = True%

[jggatter]

Hi @sayeedhussain, my organization is encountering the same response and has a config that appears to be roughly the same, but I don't have enough information to guarantee we have the same issue.

On further investigation, this is the error received
{'error': 'invalid_grant', 'error_description': "The application's assurance requirements are not met by the 'subject_token'."}

It would be great if you could clarify, how did you find this error message? Did you modify or debug the code to inspect the response object? Any specifics would be helpful!