<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello everyone,</p>
<p>I need help with the following problem:<br>
<br>
I have an IdP, configured as a SAML Proxy to an EntraID/Azure AD
instance.<br>
<br>
One of the SPs authenticating against it is requesting the
following AuthnContext and the IdP forwards this in it's SAML
request to EntraID when authenticating against that, as it should.</p>
<p>```<br>
<span class="hljs-tag"><<span class="hljs-name">samlp:RequestedAuthnContext</span>
<span class="hljs-attr">Comparison</span>=<span
class="hljs-string">"exact"</span>></span> <span
class="hljs-tag"><<span class="hljs-name">saml:AuthnContextClassRef</span>></span>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<span
class="hljs-tag"></<span class="hljs-name">saml:AuthnContextClassRef</span>></span>
<span class="hljs-tag"><<span class="hljs-name">saml:AuthnContextClassRef</span>></span>urn:oasis:names:tc:SAML:2.0:ac:classes:X509<span
class="hljs-tag"></<span class="hljs-name">saml:AuthnContextClassRef</span>></span>
<span class="hljs-tag"><<span class="hljs-name">saml:AuthnContextClassRef</span>></span>urn:oasis:names:tc:SAML:2.0:ac:classes:Multifactor<span
class="hljs-tag"></<span class="hljs-name">saml:AuthnContextClassRef</span>></span>
<span class="hljs-tag"><<span class="hljs-name">saml:AuthnContextClassRef</span>></span>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordlessPhoneSignIn<span
class="hljs-tag"></<span class="hljs-name">saml:AuthnContextClassRef</span>></span>
<span class="hljs-tag"></<span class="hljs-name">samlp:RequestedAuthnContext</span>></span><br>
```<br>
</p>
<p>The Problem arises when someone is using a method, other than
password login for authentication. EntraID only seems to check if
the login fulfills the "PasswordProtectedTransport" requirement
and ignores the other options.</p>
<p>In my case, I reproduced the problem by using a yubikey, which
resultet in the following error message on the EntraID login mask:<br>
<br>
"Authentication method 'MultiFactor, Fido' by which the user
authenticated with the service doesn't match requested
authentication method 'Password, ProtectedTransport'." <br>
</p>
<p>and I have also seen this error<br>
<br>
"Authentication method 'X509, MultiFactor,
PasswordlessPhoneSignIn' by which the user authenticated with the
service doesn't match requested authentication method 'Password,
ProtectedTransport'."</p>
<p><br>
</p>
<p>I only have control over the IdP so I concluded, that I somehow
have to remove these requirements from the SAML request to
EntraID, because it seemingly can't handle them correctly - but
haven't found instructions for that in the documentation.<br>
<br>
I hope someone can help me with this.</p>
<p><br>
</p>
Thank you in advance,<br>
<br>
Anselm Herkströter
<p></p>
</body>
</html>