SSO/SAML login for Windows Hello enrolled users fails #5320

New Issue

OVERLORD · 2026-02-05T09:57:39+03:00

OVERLORD commented

2026-02-05 09:57:39 +03:00

Originally created by @blauwkeut on GitHub (Jun 18, 2025).

Describe the Bug

We have Entra SAML login enabled for BookStack, which works fine.

However, we noticed that users enrolled in Windows Hello and have logged in with an Hello method (PIN, biometrics) on their computer, receive an AADSTS75011 error. They cannot log in with SSO.

In a browser not passing Windows Authentication, SSO still works. E.g. in Firefox, you can choose to enable Windows SSO Login - when enabled, login fails, when disabled, SAML login works fine. https://support.mozilla.org/en-US/kb/windows-sso

Full error message:
AADSTS75011: Authentication method 'X509, MultiFactor, X509Device' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the BookStack application owner.

MS learn article on this error:
https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-AADSTS75011-auth-method-mismatch

Steps to Reproduce

Working Docker BookStack stack
SAML configured with our company Entra AD
Log in with username/password credentials into Windows
SAML SSO login to BookStack works to fine
Log out of Windows
Log in with Windows Hello using e.g. PIN or biometrics
SAML SSO login to BookStack fails

Expected Behaviour

SSO login when using Windows Hello should also work
What environment variables should be set up in the Docker Compose to allow this?

Screenshots or Additional Context

Browser Details

Latest FireFox, Edge

Exact BookStack Version

BookStack v25.02.5

Originally created by @blauwkeut on GitHub (Jun 18, 2025). ### Describe the Bug We have Entra SAML login enabled for BookStack, which works fine. However, we noticed that users enrolled in Windows Hello and have logged in with an Hello method (PIN, biometrics) on their computer, receive an AADSTS75011 error. They cannot log in with SSO. In a browser not passing Windows Authentication, SSO still works. E.g. in Firefox, you can choose to enable Windows SSO Login - when enabled, login fails, when disabled, SAML login works fine. [https://support.mozilla.org/en-US/kb/windows-sso](https://support.mozilla.org/en-US/kb/windows-sso) Full error message: `AADSTS75011: Authentication method 'X509, MultiFactor, X509Device' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the BookStack application owner.` MS learn article on this error: [https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-AADSTS75011-auth-method-mismatch](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-AADSTS75011-auth-method-mismatch) ### Steps to Reproduce 1. Working Docker BookStack stack 2. SAML configured with our company Entra AD 3. Log in with username/password credentials into Windows 4. SAML SSO login to BookStack works to fine 5. Log out of Windows 5. Log in with Windows Hello using e.g. PIN or biometrics 6. SAML SSO login to BookStack fails ### Expected Behaviour * SSO login when using Windows Hello should also work * What environment variables should be set up in the Docker Compose to allow this? ### Screenshots or Additional Context ![Image](https://github.com/user-attachments/assets/5f1f03be-06eb-4b4e-8c90-d3a0d9c80a53) ### Browser Details Latest FireFox, Edge ### Exact BookStack Version BookStack v25.02.5

OVERLORD added the 🐛 Bug label 2026-02-05 09:57:39 +03:00

OVERLORD closed this issue

2026-02-05 09:57:40 +03:00

OVERLORD commented

2026-02-05 09:57:42 +03:00

@ssddanbrown commented on GitHub (Jun 18, 2025):

Hi @blauwkeut,

Try setting SAML2_IDP_AUTHNCONTEXT to false in your env config for BookStack.

@ssddanbrown commented on GitHub (Jun 18, 2025): Hi @blauwkeut, Try setting `SAML2_IDP_AUTHNCONTEXT` to `false` in your env config for BookStack.

OVERLORD commented

2026-02-05 09:57:43 +03:00

@blauwkeut commented on GitHub (Jun 19, 2025):

Thank you for the response, setting the value to false does indeed work.

For completeness sake I found SAML2_IDP_AUTHNCONTEXT="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" which also works, as this basically is the same as "allow any authentication method".

@blauwkeut commented on GitHub (Jun 19, 2025): Thank you for the response, setting the value to false does indeed work. For completeness sake I found `SAML2_IDP_AUTHNCONTEXT="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"` which also works, as this basically is the same as "allow any authentication method".

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5320