starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-02-07 19:06:05 +03:00
Code Issues 784 Packages Projects Releases 10 Wiki Activity

SSO/SAML login for Windows Hello enrolled users fails #5514

New Issue
Open
opened 2026-02-05 10:08:01 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2026-02-05 10:08:01 +03:00
Owner
Copy Link

Originally created by @schluis96 on GitHub (Nov 21, 2025).

Describe the Bug

We have Entra SAML login enabled for BookStack, which works fine.

However, we noticed that users enrolled in Windows Hello and have logged in with an Hello method (PIN, biometrics) on their computer, receive an AADSTS75011 error. They cannot log in with SSO.

In a browser not passing Windows Authentication, SSO still works.

Full error message:

AADSTS75011: Authentication method 'X509, MultiFactor, X509Device' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the BookStack application owner.

I see this ISSUE https://github.com/BookStackApp/BookStack/issues/5660 and I try with the 2 options. See screenshot

Steps to Reproduce

  1. Working Docker BookStack in Azure App Service
  2. SAML configured with our company Entra AD
  3. Log in with username/password credentials into Windows
  4. SAML SSO login to BookStack works to fine
  5. Log out of Windows
  6. Log in with Windows Hello using e.g. PIN or biometrics
  7. SAML SSO login to BookStack fails

Expected Behaviour

SSO login when using Windows Hello should also work
What environment variables should be set up in the Docker Compose to allow this?

Screenshots or Additional Context

Image Image Image

Browser Details

Microsoft Edge version 142.0.03595.90 64Bits

Exact BookStack Version

v24.10.2

Originally created by @schluis96 on GitHub (Nov 21, 2025). ### Describe the Bug We have Entra SAML login enabled for BookStack, which works fine. However, we noticed that users enrolled in Windows Hello and have logged in with an Hello method (PIN, biometrics) on their computer, receive an AADSTS75011 error. They cannot log in with SSO. In a browser not passing Windows Authentication, SSO still works. ### Full error message: ``` AADSTS75011: Authentication method 'X509, MultiFactor, X509Device' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the BookStack application owner. ``` I see this ISSUE https://github.com/BookStackApp/BookStack/issues/5660 and I try with the 2 options. See screenshot ### Steps to Reproduce 1. Working Docker BookStack in Azure App Service 2. SAML configured with our company Entra AD 3. Log in with username/password credentials into Windows 4. SAML SSO login to BookStack works to fine 5. Log out of Windows 6. Log in with Windows Hello using e.g. PIN or biometrics 7. SAML SSO login to BookStack fails ### Expected Behaviour SSO login when using Windows Hello should also work What environment variables should be set up in the Docker Compose to allow this? ### Screenshots or Additional Context <img width="597" height="716" alt="Image" src="https://github.com/user-attachments/assets/dc032ee8-1164-4ec6-bfa2-47bb25969f10" /> <img width="768" height="119" alt="Image" src="https://github.com/user-attachments/assets/ca6156d6-9565-4979-9456-cbedd36b6e41" /> <img width="714" height="118" alt="Image" src="https://github.com/user-attachments/assets/b9ca5b98-2ad8-46f9-951a-e9df3c6baf04" /> ### Browser Details Microsoft Edge version 142.0.03595.90 64Bits ### Exact BookStack Version v24.10.2
OVERLORD added the 🐕 Support label 2026-02-05 10:08:01 +03:00
OVERLORD commented 2026-02-05 10:08:04 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Nov 21, 2025):

Hi @schluis96,
Have you read https://github.com/BookStackApp/BookStack/issues/5660 which covers the same thing?

@ssddanbrown commented on GitHub (Nov 21, 2025): Hi @schluis96, Have you read https://github.com/BookStackApp/BookStack/issues/5660 which covers the same thing?
OVERLORD commented 2026-02-05 10:08:05 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Nov 21, 2025):

Ah, I see you have.

How are you setting .env options? and how are you running BookStack? What's the method of installation used?

@ssddanbrown commented on GitHub (Nov 21, 2025): Ah, I see you have. How are you setting `.env` options? and how are you running BookStack? What's the method of installation used?
OVERLORD commented 2026-02-05 10:08:06 +03:00
Author
Owner
Copy Link

@schluis96 commented on GitHub (Nov 21, 2025):

Yes sir, I have tested both configurations and neither of them is working.

@schluis96 commented on GitHub (Nov 21, 2025): Yes sir, I have tested both configurations and neither of them is working.
OVERLORD commented 2026-02-05 10:08:08 +03:00
Author
Owner
Copy Link

@schluis96 commented on GitHub (Nov 21, 2025):

We have used the code, built the Docker image, and deployed it to the App Service. I have attached screenshots of the .env configuration, and I have tested both options.

Dockerfile

# Utiliza PHP 8.3 con Apache
FROM php:8.3-apache

# Instalar dependencias adicionales y extensiones de PHP
RUN apt-get update && apt-get install -y \
    git \
    unzip \
    libpng-dev \
    libjpeg-dev \
    libfreetype6-dev \
    libonig-dev \
    libxml2-dev \
    zip \
    curl \
    dialog \
    openssh-server

# Configurar contraseña para el acceso SSH
RUN echo "root:Docker!" | chpasswd

# Instalar la extensión GD
RUN docker-php-ext-configure gd --with-freetype --with-jpeg \
    && docker-php-ext-install -j$(nproc) gd

# Instalar otras extensiones de PHP
RUN docker-php-ext-install -j$(nproc) pdo_mysql mbstring xml dom opcache

# Instalar Composer
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

# Definir la variable ARG para usar durante la construcción
ARG APP_ENV

# Definir la variable de entorno para persistir en tiempo de ejecución
ENV APP_ENV=${APP_ENV}

# Configurar Apache en función del entorno
RUN if [ "$APP_ENV" = "testing" ]; then \
    echo "Configurando Apache para el entorno de testing"; \
    sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n    AllowOverride All\n    Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/ServerAdmin/a ServerName wiki-test.fibermancha.es' /etc/apache2/sites-available/000-default.conf \
    && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \
  elif [ "$APP_ENV" = "production" ]; then \
    echo "Configurando Apache para el entorno de producción"; \
    sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n    AllowOverride All\n    Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/ServerAdmin/a ServerName wiki.fibermancha.es' /etc/apache2/sites-available/000-default.conf \
    && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \
  else \
    echo "Configurando Apache para localhost (docker local)"; \
    sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n    AllowOverride All\n    Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \
    && sed -i '/ServerAdmin/a ServerName localhost' /etc/apache2/sites-available/000-default.conf \
    && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \
  fi

# Habilitar el módulo de reescritura en Apache
RUN a2enmod rewrite

# Establecer el directorio de trabajo
WORKDIR /var/www/html

# Copiar los archivos del repositorio local al contenedor
COPY . /var/www/html

# Ejecutar composer update antes de composer install
RUN composer update --no-dev --optimize-autoloader

# Configurar Git para permitir el directorio seguro
RUN git config --global --add safe.directory /var/www/html

# Limpiar caché de Composer y actualizar dependencias
RUN composer clear-cache \
    && composer install --no-dev --optimize-autoloader

# Mostrar el valor de APP_ENV en los logs
RUN echo "El valor de APP_ENV es: $APP_ENV"

# Verificar la presencia de archivos .env
RUN ls -la /var/www/html


# Verificar si el archivo .env fue generado correctamente en el build
RUN if [ ! -f /var/www/html/.env ]; then \
    echo "El archivo .env no se ha copiado correctamente"; \
    exit 1; \
else \
    echo "El archivo .env se ha generado correctamente"; \
fi

# Mostrar el contenido del archivo .env para depuración
RUN echo "Contenido del archivo .env:" && cat /var/www/html/.env

# Verificar el contenido de nuevo después de copiar .env
RUN ls -la /var/www/html

# Generar clave de aplicación si no está ya presente en .env
RUN php artisan key:generate --force

# Asegurar que las carpetas necesarias son accesibles por Apache
RUN chown -R www-data:www-data storage bootstrap/cache public/uploads

# Configurar SSH
COPY sshd_config /etc/ssh/
COPY entrypoint.sh ./ 
RUN chmod u+x ./entrypoint.sh

# Exponer puertos para la aplicación y SSH
EXPOSE 80 2222

# Ejecutar migraciones si es necesario
RUN php artisan migrate --force || true

# Ejecutar el script de entrada
ENTRYPOINT ["./entrypoint.sh"]
@schluis96 commented on GitHub (Nov 21, 2025): We have used the code, built the Docker image, and deployed it to the App Service. I have attached screenshots of the .env configuration, and I have tested both options. Dockerfile ``` # Utiliza PHP 8.3 con Apache FROM php:8.3-apache # Instalar dependencias adicionales y extensiones de PHP RUN apt-get update && apt-get install -y \ git \ unzip \ libpng-dev \ libjpeg-dev \ libfreetype6-dev \ libonig-dev \ libxml2-dev \ zip \ curl \ dialog \ openssh-server # Configurar contraseña para el acceso SSH RUN echo "root:Docker!" | chpasswd # Instalar la extensión GD RUN docker-php-ext-configure gd --with-freetype --with-jpeg \ && docker-php-ext-install -j$(nproc) gd # Instalar otras extensiones de PHP RUN docker-php-ext-install -j$(nproc) pdo_mysql mbstring xml dom opcache # Instalar Composer RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer # Definir la variable ARG para usar durante la construcción ARG APP_ENV # Definir la variable de entorno para persistir en tiempo de ejecución ENV APP_ENV=${APP_ENV} # Configurar Apache en función del entorno RUN if [ "$APP_ENV" = "testing" ]; then \ echo "Configurando Apache para el entorno de testing"; \ sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \ && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n AllowOverride All\n Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \ && sed -i '/ServerAdmin/a ServerName wiki-test.fibermancha.es' /etc/apache2/sites-available/000-default.conf \ && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \ elif [ "$APP_ENV" = "production" ]; then \ echo "Configurando Apache para el entorno de producción"; \ sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \ && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n AllowOverride All\n Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \ && sed -i '/ServerAdmin/a ServerName wiki.fibermancha.es' /etc/apache2/sites-available/000-default.conf \ && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \ else \ echo "Configurando Apache para localhost (docker local)"; \ sed -i 's|DocumentRoot /var/www/html|DocumentRoot /var/www/html/public|g' /etc/apache2/sites-available/000-default.conf \ && sed -i '/DocumentRoot/a <Directory /var/www/html/public>\n AllowOverride All\n Require all granted\n</Directory>' /etc/apache2/sites-available/000-default.conf \ && sed -i '/ServerAdmin/a ServerName localhost' /etc/apache2/sites-available/000-default.conf \ && sed -i 's|LogLevel .*|LogLevel warn|g' /etc/apache2/sites-available/000-default.conf; \ fi # Habilitar el módulo de reescritura en Apache RUN a2enmod rewrite # Establecer el directorio de trabajo WORKDIR /var/www/html # Copiar los archivos del repositorio local al contenedor COPY . /var/www/html # Ejecutar composer update antes de composer install RUN composer update --no-dev --optimize-autoloader # Configurar Git para permitir el directorio seguro RUN git config --global --add safe.directory /var/www/html # Limpiar caché de Composer y actualizar dependencias RUN composer clear-cache \ && composer install --no-dev --optimize-autoloader # Mostrar el valor de APP_ENV en los logs RUN echo "El valor de APP_ENV es: $APP_ENV" # Verificar la presencia de archivos .env RUN ls -la /var/www/html # Verificar si el archivo .env fue generado correctamente en el build RUN if [ ! -f /var/www/html/.env ]; then \ echo "El archivo .env no se ha copiado correctamente"; \ exit 1; \ else \ echo "El archivo .env se ha generado correctamente"; \ fi # Mostrar el contenido del archivo .env para depuración RUN echo "Contenido del archivo .env:" && cat /var/www/html/.env # Verificar el contenido de nuevo después de copiar .env RUN ls -la /var/www/html # Generar clave de aplicación si no está ya presente en .env RUN php artisan key:generate --force # Asegurar que las carpetas necesarias son accesibles por Apache RUN chown -R www-data:www-data storage bootstrap/cache public/uploads # Configurar SSH COPY sshd_config /etc/ssh/ COPY entrypoint.sh ./ RUN chmod u+x ./entrypoint.sh # Exponer puertos para la aplicación y SSH EXPOSE 80 2222 # Ejecutar migraciones si es necesario RUN php artisan migrate --force || true # Ejecutar el script de entrada ENTRYPOINT ["./entrypoint.sh"] ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label 🐕 Support
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#5514
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?