Hey I can help here. I had the same problem. The issue is the order you have entered the information in the google user profile.
Google and AWS don't care, but this command line does. ;)

Doesn't work ,
arn:aws:iam::xxxx:saml-provider/Google,arn:aws:iam::xxx:role/sso-sysadmin

works ,
arn:aws:iam::xxx:role/sso-sysadmin,arn:aws:iam::xxxx:saml-provider/Google

issue is here: https://github.com/cevoaustralia/aws-google-auth/blob/master/aws_google_auth/amazon.py#L83

parsing for iam is not enough. it has to check for saml-provider

There's actually another reason this can fail -- a space after the comma. I had configured <role_arn>, <provider_arn>.

A simple trim() on the values would avoid this.

If you have a sample SAML response that we can write a test against to validate this, I'd be happy to included it in the codebase.

I'm trying to increase the test coverage with real(ish) world examples to increase the resilience.

@demon is right, I have just seen the problem because of a comma. strip() FTW.

Quite annoying issue, specially in large organizations where one does not have direct access to the google profile configuration...

I created a PR to try to fix this. Happy to discuss changes 😀