SSO: Unable to sign-in with Entra when user logged in via other method

[knolleary]

Current Behavior

A self-hosted user reports:

I've configured SSO in FlowFuse and I've got the app registered with Entra ID, but I'm getting this error:

AADSTS75011: Authentication method 'X509, MultiFactor, PasswordlessPhoneSignIn' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the Flow Fuse application owner.

For context, our use case in this instance is that once a user has authenticated with Entra ID, then they won't need to sign in again until their credentials expire. As the error message says, we also use PasswordlessPhoneSignIn

I've done some troubleshooting and the resolution guidance from MS is:

Root cause: The application is requesting the user to sign in using a specific method but the user has already authenticated with a different method prior to access the application. For example, in the SAML request the application has a RequestedAuthnContext with the specific AuthnContextClassRef value urn:oasis:names:tc:SAML:2.0:ac:classes:Password but the user has used multifactor authentication to sign in.
Resolution:
Request to the developer of the application to remove the RequestedAuthnContext from the SAML request.
Another option is to request the application owner to always prompt the user for a fresh authentication. To accomplish this, the application needs to add the value forceAuthn="true" as a parameter in the request to Microsoft Entra ID.

Expected Behavior

Can login via SSO/Entra when other methods are used.

Steps To Reproduce

No response

Environment

• FlowFuse version:
• Node.js version:
• npm version:
• Platform/OS:
• Browser:

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

[knolleary]

We can remove the RequestedAuthnContext from the SAML request: node-saml/passport-saml#226

The question is whether any of our other supported Idps require that header... will need to retest against them all.