Bug Description

When the configured aws_session_duration exceeds the IAM role's MaxSessionDuration, saml2aws exits with a ValidationError instead of falling back to the role's maximum allowed duration.

Error Message

Error logging into AWS role using SAML assertion.: Error retrieving STS credentials using SAML.: ValidationError: The requested DurationSeconds exceeds the MaxSessionDuration set for this role.
status code: 400, request id: e8f027af-xxxx-xxxx-xxxx-5def568bcff2(Masked Id for privacy)

Steps to Reproduce

1. Configure saml2aws with aws_session_duration = 43200 (12 hours)
2. Use an IAM role with MaxSessionDuration less than 12 hours (e.g., 1 hour/3600 seconds)
3. Run saml2aws login
4. Error occurs preventing login

Expected Behavior

When the requested session duration exceeds the role's limit, saml2aws should:

1. Detect the ValidationError
2. Log a warning message
3. Automatically retry with the role's default/maximum duration
4. Complete the login successfully

Current Behavior

saml2aws exits with an error, preventing login entirely.

Environment

• saml2aws version: 2.36.19
• Platform: Windows/Linux/macOS
• IdP: Okta (may affect other providers as well)

Configuration Example

[default]
aws_session_duration = 43200

Workaround

Manually set aws_session_duration to match or be lower than the role's MaxSessionDuration, but this requires knowing each role's limit beforehand.

Proposed Solution

Add error handling in the loginToStsUsingRole function to:

1. Catch the specific ValidationError about MaxSessionDuration
2. Retry the AssumeRoleWithSAML call without the DurationSeconds parameter
3. Let AWS use the role's configured maximum
4. Provide clear user feedback about what happened
5. This provides a better user experience by automatically handling the common misconfiguration case.