# Type of request: This is a ...

[X] bug report
[ ] feature request

# Detailed description

When I try to retrieve credentials with `assume_role_with_saml` using boto3 v1.16.26 the following error occured:

```
  File "/Users/benjamin.brabant/Projects/OCTO/DSI/awscli-saml-sso/.venv/lib/python3.8/site-packages/botocore/parsers.py", line 505, in _do_error_parse
    root = self._parse_xml_string_to_dom(xml_contents)
  File "/Users/benjamin.brabant/Projects/OCTO/DSI/awscli-saml-sso/.venv/lib/python3.8/site-packages/botocore/parsers.py", line 454, in _parse_xml_string_to_dom
    raise ResponseParserError(
botocore.parsers.ResponseParserError: Unable to parse response (not well-formed (invalid token): line 1, column 0), invalid XML received. Further retries may succeed:
b'{"status": "running"}'
```

## Expected behavior

I expected to retrieve credentials from API in the following form:
```
{
    "Credentials": {
        "AccessKeyId": "ASIA...",
        "SecretAccessKey": "...",
        "SessionToken": "FQoGZXIvYXdzEBYaDwL8pPz/cNvhUKkibZTashetWcPahlTMbaBUvDwXxjiehDkRQGYYUQrTrMdv7+6SinGiDNBiB7ZKEoyfDja6vhHwnBP2UcY/XozN+MFFPGEMhHcsUqPApwOErN37uHAM5kIOukhGlNmIPvPVWZtDoWryAuygKbqZTWwKecCwtURG2I0KF8MpS+s6SaG6EOUl5OJf/mJJQvH725q2VOWUk7HBezFCIXO+t3L8SzMygdt2FNzwUenhazYvDs2ngSlsbFbAaeeMHikZrWgTs6GkUv1uyAknpTRnInmwBDHb7SZAqpDmc7Q9+b+NXTcO1qzx/eMarHHlFQyeEEI3BEc=",
        "Expiration": "2020-12-06T18:54:38.114Z"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA3X42LBCD9KGW7O43L:benjamin.brabant",
        "Arn": "arn:aws:sts::123456789012:assumed-role/Role.Admin/benjamin.brabant"
    },
    "Subject": "AROA3X42LBCD9KGW7O43L:benjamin.brabant",
    "SubjectType": "persistent",
    "Issuer": "http://localhost:3000/",
    "Audience": "https://signin.aws.amazon.com/saml",
    "NameQualifier": "B64EncodedStringOfHashOfIssuerAccountIdAndUserId="
}
```


## Actual behavior

In localstack logs, I have the following information:

```
localstack    | 2020-12-07T09:36:13:INFO:localstack.services.edge: Unable to find forwarding rule for host "localhost:4577", path "/", target header "", auth header "", data "b'Action=AssumeRoleWithSAML&Version=2011-06-15&RoleArn=arn%3Aaws%3Aiam%3A%3A000000000000%3Arole%2FRole'..."
```

I also try to call localstack from awscli with the following command:
```
AWS_ACCESS_KEY_ID='_not_needed_locally_' AWS_SECRET_ACCESS_KEY='_not_needed_locally_' aws --endpoint-url=http://localhost:4577 sts assume-role-with-saml \
    --role-arn arn:aws:iam::000000000000:role/Role.Admin \
    --principal-arn arn:aws:iam::000000000000:saml-provider/SamlExampleProvider \
    --saml-assertion $(cat samlresponse.xml | base64)
```

Which respond only `'AssumeRoleWithSAMLResult'`

# Steps to reproduce

## Command used to start LocalStack

I start localstack through docker-compose:

```
  localstack:
    image: localstack/localstack:0.12.2
    container_name: localstack
    restart: always
    ports:
      - "4577:4566"
      - "4592:4592"
    environment:
      LOCALSTACK_SERVICES: iam, sts, s3
      LOCALSTACK_START_WEB: 0
      LOCALSTACK_DATA_DIR: /tmp/localstack/data
      LOCALSTACK_DOCKER_HOST: unix:///var/run/docker.sock
      LOCALSTACK_S3_BUCKET_NAME: example-bucket
      LOCALSTACK_DEBUG: 1
    volumes:
      - localstack-s3-data:/tmp/localstack
      - ./docker/localstack:/docker-entrypoint-initaws.d
```

and init script in `docker/localstack`:

```
echo "Creating AWS S3 bucket $LOCALSTACK_S3_BUCKET_NAME..."
awslocal s3api create-bucket --bucket $LOCALSTACK_S3_BUCKET_NAME

echo "Creating AWS SAML Provider SamlExampleProvider..."
awslocal iam create-saml-provider --name SamlExampleProvider --saml-metadata-document file:///docker-entrypoint-initaws.d/SAML-Metadata-IDPSSODescriptor.xml

echo "Creating AWS Role.User..."
awslocal iam create-role --role-name Role.User --path / --assume-role-policy-document file:///docker-entrypoint-initaws.d/test-role-trust-relationship-policy.json
awslocal iam put-role-policy --role-name Role.User --policy-name UserPolicy --policy-document file:///docker-entrypoint-initaws.d/test-role-policy.json

echo "Creating AWS Role.Admin..."
awslocal iam create-role --role-name Role.Admin --path / --assume-role-policy-document file:///docker-entrypoint-initaws.d/test-role-trust-relationship-policy.json
awslocal iam put-role-policy --role-name Role.Admin --policy-name AdminPolicy --policy-document file:///docker-entrypoint-initaws.d/test-role-policy.json

echo "... Finished"
```

## Client code (AWS SDK code snippet, or sequence of "awslocal" commands)

```
    client = boto3.client("sts", endpoint_url=endpoint_url)
    sts_response = client.assume_role_with_saml(RoleArn=role_arn, PrincipalArn=principal_arn, SAMLAssertion=assertion)
```
test_role_session_name = 's3-access-example'
        test_role_arn = 'arn:aws:sts::000000000000:role/rd_role'
        response = self.sts_client.assume_role(RoleArn=test_role_arn, RoleSessionName=test_role_session_name)
        self.assertTrue(response['Credentials'])
        self.assertTrue(response['Credentials']['SecretAccessKey'])
        if response['AssumedRoleUser']['AssumedRoleId']:
            assume_role_id_parts = response['AssumedRoleUser']['AssumedRoleId'].split(':')
            self.assertEqual(assume_role_id_parts[1], test_role_session_name)
    def test_assume_role_with_web_identity(self):
        test_role_session_name = 'web_token'
        test_role_arn = 'arn:aws:sts::000000000000:role/rd_role'
        test_web_identity_token = 'token'
        response = self.sts_client.assume_role_with_web_identity(RoleArn=test_role_arn,
                                                                RoleSessionName=test_role_session_name,
                                                                WebIdentityToken=test_web_identity_token)
        self.assertTrue(response['Credentials'])
        self.assertTrue(response['Credentials']['SecretAccessKey'])
        if response['AssumedRoleUser']['AssumedRoleId']:
            assume_role_id_parts = response['AssumedRoleUser']['AssumedRoleId'].split(':')
            self.assertEqual(assume_role_id_parts[1], test_role_session_name)
    def test_get_federation_token(self):
        token_name = 'TestName'
        response = self.sts_client.get_federation_token(Name=token_name)
        self.assertTrue(response['Credentials'])
        self.assertTrue(response['Credentials']['SecretAccessKey'])
        self.assertTrue(response['Credentials']['SessionToken'])
        self.assertTrue(response['Credentials']['Expiration'])
        federated_user_info = response['FederatedUser']['FederatedUserId'].split(':')
        self.assertEqual(federated_user_info[1], token_name)