[PR #2171] [CLOSED] Make RequestedAuthnContext configurable in SAML2 #5955

New Issue

OVERLORD · 2026-02-05T10:21:16+03:00

OVERLORD commented

2026-02-05 10:21:16 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/2171
Author: @Ant1x
Created: 7/6/2020
Status: ❌ Closed

Base: master ← Head: saml2-authn-context

📝 Commits (2)

374b70f Add requestedAuthnContext configurable to Saml2
4ac1071 Include Saml2 requested authn context

📊 Changes

2 files changed (+5 additions, -1 deletions)

View changed files

📝 .env.example.complete (+2 -1)
📝 app/Config/saml2.php (+3 -0)

📄 Description

When using SAML IDP providers that have different authentication methods available, authentication will occasionally fail since by default the OneLogin SAML library sets requestedAuthnContext to true.

This has the effect of requiring the exact urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport authentication context from the IDP (Refer to README: https://github.com/onelogin/php-saml)

I've been getting SAML to work with Microsoft ADFS that is configured with a range of different authentication mechanisms, and in this configuration ADFS is unable to authenticate a request that asks for PasswordProtectedTransport

In this PR I have made this option configurable by setting SAML2_REQUESTED_AUTHN_CONTEXT in the env config file. I have made it default to true as to not change the current working configuration for already deployed Bookstack instances.

Setting SAML2_REQUESTED_AUTHN_CONTEXT to false will send an authentication request to the IDP without specifying any authentication context, allowing the IDP to select the most appropriate method to authenticate the end user.

Setting SAML2_REQUESTED_AUTHN_CONTEXT to true or not configuring it will keep the same behavior of requesting PasswordProtectedTransport.

(Note: The online GitHub editor has automatically added a newline to the .env.example.complete file)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/2171 **Author:** [@Ant1x](https://github.com/Ant1x) **Created:** 7/6/2020 **Status:** ❌ Closed **Base:** `master` ← **Head:** `saml2-authn-context` --- ### 📝 Commits (2) - [`374b70f`](https://github.com/BookStackApp/BookStack/commit/374b70f0addace4999319cc2ebce0e010cfe2f6a) Add requestedAuthnContext configurable to Saml2 - [`4ac1071`](https://github.com/BookStackApp/BookStack/commit/4ac1071273aad4f60d97d73cc347c5bcc897fc5b) Include Saml2 requested authn context ### 📊 Changes **2 files changed** (+5 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.env.example.complete` (+2 -1) 📝 `app/Config/saml2.php` (+3 -0) </details> ### 📄 Description When using SAML IDP providers that have different authentication methods available, authentication will occasionally fail since by default the OneLogin SAML library sets `requestedAuthnContext` to `true`. This has the effect of requiring the `exact` `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport` authentication context from the IDP (Refer to README: https://github.com/onelogin/php-saml) I've been getting SAML to work with Microsoft ADFS that is configured with a range of different authentication mechanisms, and in this configuration ADFS is unable to authenticate a request that asks for `PasswordProtectedTransport` In this PR I have made this option configurable by setting `SAML2_REQUESTED_AUTHN_CONTEXT` in the env config file. I have made it default to `true` as to not change the current working configuration for already deployed Bookstack instances. Setting `SAML2_REQUESTED_AUTHN_CONTEXT` to `false` will send an authentication request to the IDP without specifying any authentication context, allowing the IDP to select the most appropriate method to authenticate the end user. Setting `SAML2_REQUESTED_AUTHN_CONTEXT` to `true` or not configuring it will keep the same behavior of requesting `PasswordProtectedTransport`. (Note: The online GitHub editor has automatically added a newline to the .env.example.complete file) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:21:16 +03:00

OVERLORD closed this issue

2026-02-05 10:21:18 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#5955