Issues with Passkey logins via Entra in SAML proxy mode.

[Robert Bradley]

On 03/08/2026 16:34, Mark Cairney via users wrote:

<on SPs requesting exact matches with PasswordProtectedTransport>

> This seems to be a common issue with Onelogin out the box: https:// 
> github.com/centreon/centreon/issues/5166
> 
> and even their sample SAML snippets include this stanza:
> 
> https://developers.onelogin.com/saml/examples/authnrequest
> 
> 
> Would I be right in suggesting they reconfigure their application to 
> either use 'minimum' instead of 'exact' or to simply omit this 
> requirement completely?

I'd omit it entirely.  Entra ID can only do exact comparisons, so you'd 
just see different breakage.  At best, you could force it to require the 
REFEDS MFA authnContextClassRef and map that to 
http://schemas.microsoft.com/claims/multipleauthn on the Entra ID side. 
If you do that though, non-MFA-capable users will fail to log in :(

It's good to know that Onelogin SPs have this sort of broken default, 
anyway.
-- 
Dr Robert Bradley
Technical Lead, Identity and Access Management Team,
IT Services, University of Oxford