SSO not working

[jonparker]

SSO opens the AWS verification page in the browser but when clicking allow it says the device code is invalid.

Normally when running aws sso login in the cli it would show something like:

"Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso..amazonaws.com/

Then enter the code:

ABCD-EFGH"

and then you would be able to check that the codes match.

[jonparker]

Me: Why would an MCP server that connects to AWS with AWS SDK for JavaScript V2 using an SSO profile in the AWS config launch a url in the default browser that shows a device code but when clicking approve on the code it says it’s an invalid code?

Claude:

This is a common issue with AWS SSO authentication flow in the AWS SDK for JavaScript V2. The problem typically occurs due to timing issues or configuration mismatches in the SSO authentication process.

Here are the most likely causes and solutions:

1. Token Expiration During Authentication
The device code has a short expiration time (usually 15 minutes). If there’s a delay between code generation and approval, or if the authentication process takes too long, the code becomes invalid.

2. SSO Session Configuration Issues

• Ensure your ~/.aws/config file has the correct SSO configuration:

[profile your-sso-profile]
sso_start_url = https://your-org.awsapps.com/start
sso_region = us-east-1
sso_account_id = 123456789012
sso_role_name = YourRoleName
region = us-east-1

3. SDK Version Compatibility
AWS SDK for JavaScript V2 has known issues with SSO authentication. Consider these solutions:

• Upgrade to AWS SDK V3: The V3 SDK has more reliable SSO support
• Use AWS CLI for initial authentication: Run aws sso login --profile your-profile-name first, then use the MCP server

4. Browser Session Conflicts

• Clear browser cookies/cache for the AWS SSO domain
• Try using an incognito/private browser window
• Ensure you’re logged into the correct AWS organization in your browser

5. Race Condition in Token Refresh
The SDK might be trying to refresh tokens while the device code flow is still active. Try:

• Clearing the SSO cache: Delete ~/.aws/sso/cache/
• Restarting the authentication flow completely

Recommended Fix:

1. Use AWS CLI to authenticate first: aws sso login --profile your-profile-name
2. Then start your MCP server, which should use the cached credentials
3. If still using SDK V2, consider migrating to V3 for better SSO support

The root cause is usually that the AWS SDK V2’s SSO implementation doesn’t handle the device code flow as reliably as newer versions or the AWS CLI.​​​​​​​​​​​​​​​​