ShibIdP v4 & Azure SAML Authentication Issue with RequestedAuthnContext

[McLennan, Neil R]

Janusz ,

Yes I have encountered this issue especially with Windows Hello. 
The following seems to work for us at the moment. 

<bean parent="RelyingPartyByName" c:relyingPartyIds="https://sts.windows.net/<entity Id>/">
<property name="profileConfigurations">
                <list>
			<bean parent="SAML2.SSO"  p:authnContextComparison="EXACT" p:proxiedAuthnInstant="false" p:ignoreScoping="true" >
			<property name="defaultAuthenticationMethods">
			<list>
			</list>
			</property>
			</bean>           
                </list>
</property>
</bean> 





-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Janusz Ulanowski
Sent: Thursday, January 11, 2024 9:08 AM
To: users at shibboleth.net
Subject: ShibIdP v4 & Azure SAML Authentication Issue with RequestedAuthnContext



We are using ShibIdP v4 as the IdP SAML proxy to Azure. It has been a while since I last worked on ShibIdP. Currently, I am trying to find a workaround for an issue that some users are experiencing.

When the IdP receives a SAML request from the Service Provider (SP) with RequestedAuthnContext and Comparison="exact," it passes that request to Azure. However, some browsers like Edge store the previous session and use X509 certificates with Azure IDP, leading to a validation failure due to an authRequest mismatch. The error on the Microsoft login site is AADSTS75011.

I am struggling to figure out how to override this behavior. Has anyone encountered a similar issue and found a fix for it?"
Thanks in advance

--

Janusz
-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net