SAML authentication with Microsoft Entra ID

mattmarch · January 29

I understand this feature is still in beta but we're having the following issue.

All of our devices are already connected to Entra SSO, and it appears that when trying to login, we'll recieve the following error:

AADSTS75011: Authentication method 'X509, MultiFactor, X509Device' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the <Application> application owner.

Upon troubleshooting in Entra, the following cause is provided:

Root cause: The application is requesting the user to sign in using a specific method but the user has already authenticated with a different method prior to access the application. For example, in the SAML request the application has a RequestedAuthnContext with the specific AuthnContextClassRef value urn:oasis:names:tc:SAML:2.0:ac:classes:Password but the user has used multifactor authentication to sign in.

Has this been reported as of yet and is it being worked on? We're keen to implement this as soon as possible.

Thanks!

Zyxel_Melen · January 29

Hi @mattmarch,

May I confirm if you follow this FAQ to configure the SAML authentication with Microsoft Entra ID but having an issue when testing?

How to configure SAML authentication with Microsoft Entra ID? — Zyxel Community

mattmarch · January 29

Hi @Zyxel_Melen,

Yes, I followed that exact guide to the letter.

I tested an Entra account which isn't tied to my machine and found that worked straight away. There seems to be an issue where the SP is sending the RequestedAuthnContext value back to the IDP but may require another value. Please see the MS KB Post here:

https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/app-integration/error-code-aadsts75011-auth-method-mismatch

Thanks as always.

Zyxel_Melen · January 29

Hi @mattmarch,

Thanks for your update. May I know the difference between the two accounts you used to test? This will help us create an FAQ for other users.

mattmarch · January 29

Hi @Zyxel_Melen,

Sure, the only difference is that the test account isn't already logged in and authenticated via the Edge browser, as well as utilizing the 'Microsoft Single Sign On' extension within Chrome. I believe the changes in the way the SP connects to the IDP needs to be reviewed, as we don't have this issue with our other SAML applications.

Thank you.

mattmarch · January 30

@Zyxel_Melen Is there any update on a potential fix for this or any advice from the development team?

mattmarch · 9:59AM

@Zyxel_Melen, it's also worth mentioning that if you're trying to connect using this mode from an iOS device, accepting any sort of authentication prompt from Microsoft is impossible as leaving the captive portal page on iOS will restart the process.

SAML authentication with Microsoft Entra ID

All Replies

Categories

Wireless Help Center