Issues with Passkey logins via Entra in SAML proxy mode.

[Peter Schober]

Mark Cairney via users <users at shibboleth.net> [2026-08-03 14:17 CEST]:
> The error in Entra is 'Authentication method 'MultiFactor,Fido' by which the
> user authenticated with the service doesn't match requested authentication
> method 'Password, ProtectedTransport'. Contact the Shibboleth-Live
> application owner.'

Look at the SAML authnRequests (e.g. using the SAML Tracer plugin for
Firefox or Chromium), what system is requesting those methods? The
original SP or your SAML IDP proxying to Entra?

(Obviously, no IDP should ever be using password-based authentication
without TLS, full stop. And no SP should ever be requesting
"ProtectedTransport" because that's the worst possible authentication
mechanism used at IDPs in practice.  I.e., the only purpose
specifically requesting "ProtectedTransport" serves is preventing
strong/-er authn methods from using used and why would an SP try to do
that?)

-peter