ShibRequestSetting forceAuthn true vs 1 vs on

[Scott Cantor]

I'm not sure what ForceAuthn in particular has to do with a timeout error, that sounds at most as though there's some login flow that needs to be adjusted in terms of whether it supports ForceAuthn perhaps, but...

> On Jun 4, 2026, at 4:06 PM, Dan McLaughlin via users <users at shibboleth.net> wrote:
> 
> I believe I have identified the cause of this behavior. From a SAML XML perspective, forceAuthn is a boolean that expects a value of 0, 1, true, or false.
> 
> It appears the SP is not converting "on" to "1" or "true" before passing it along. Instead, it passes the value literally as "on," which causes the process to break.

I don't have time to check into it right now, but file a bug and I'll verify how the ShibRequestSetting command parsing is handling that. The On/Off syntax is more Apache and that just translates internally into a boolean, but that's only for single argument commands.

ShibRequestSetting is parsed by additional code to handle boolean settings and it might be mishandling or explicitly not handling On/Off and it's just treating "not 1/true" as false.

I would not, certainly, suggest that On/Off is a good ides in that command, but I understand the reason to accidentally do it.

-- Scott