SAML SSO Option: forceAuthn

[MordyT]

From: https://github.com/bergie/passport-saml

forceAuthn: if set to true, the initial SAML request from the service provider specifies that the IdP should force re-authentication of the user, even if they possess a valid session.

Is there a variable in mesh config that I can use to set this to false? Scanning through the code I see exactly 3 places this is mentioned - in the saml.js, in the readme.md, and in the passport-saml\test\tests.js

[Ylianst]

Currently there is not config.json setting for this, but I can add it. In this case, the default is probably false already. If you want, I can add a setting for this. You can go in the code now and test any option you like by adding things to "options" at this location.

[MordyT]

Gotcha. I'm still trying to debug why this 1 saml application requires re-auth and thought it might be that. I'll test and let you know.

[MordyT]

@Ylianst
So after much testing...

I need an option for this:
disableRequestedAuthnContext
(and not the one I originally requested)

With ADFS, you want this to be true in order for SSO to not require re-authentication.

See: https://github.com/bergie/passport-saml
disableRequestedAuthnContext: if truthy, do not request a specific authentication context. This is known to help when authenticating against Active Directory (AD FS) servers.
And: node-saml/passport-saml#226

Here is what I did:

Not everyone is using ADFS, so I recommend it be an option in the SAML portion of the config.

[Ylianst]

Nice! Thank you for that research, I would have never been able to find that. I added the new option in the sample-config-advanced.json. You have to remove the "_" and it should work. Will be in v0.5.47 when it's next published.

"saml": {
  "_callbackurl": "https://server/auth-saml-callback",
  "_disableRequestedAuthnContext": true, <---------
  "newAccounts": true,
  "_newAccountsUserGroups": [ "ugrp//xxxxxxxxxxxxxxxxx" ],
  "entityid": "meshcentral",
  "idpurl": "https://server/saml2",
  "cert": "saml.pem"
}

[MordyT]

Working perfectly!