> Any pointers on how forced authentication has to be configured? > Does it work on the IdP or should it be configured on the SP? ForceAuthn is a SAML request flag, it comes from the SP. -- Scott