ShibRequestSetting forceAuthn true vs 1 vs on

[Dan McLaughlin]

I believe I have identified the cause of this behavior. From a SAML XML
perspective, forceAuthn is a boolean that expects a value of 0, 1, true, or
false.

It appears the SP is not converting "on" to "1" or "true" before passing it
along. Instead, it passes the value literally as "on," which causes the
process to break.

Some clarification in the SP docs, or a warning, might be helpful if this
is the cause.


Dan


On Thu, Jun 4, 2026 at 2:59 PM Dan McLaughlin <
dmclaughlin at tech-consortium.com> wrote:

> I am looking for clarification regarding the behavior of forceAuthn within
> SP 3, Embedded DS, and IDP 5.1.x.
>
> According to the SP documentation, the values "1", "true", and "On" should
> be interchangeable for boolean settings. However, we recently encountered
> an issue where setting ShibRequestSetting forceAuthn on caused users to get
> stuck in a loop if they took too long to complete MFA, resulting in the
> error: "The gap between now and the time you logged into your identity
> provider exceeds the allowed limit."
>
> Changing the configuration to ShibRequestSetting forceAuthn true resolved
> the issue, and the IDP now correctly forces authentication, breaking the
> loop.
>
> Could someone familiar with the internals of these components explain why
> "on" and "true" appear to behave differently in this context? I would like
> to know if this is a known bug or if I am misinterpreting the documentation.
>
> Thanks,
>
> Dan
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260604/862cafa2/attachment.htm>