Add support Windows Authentication via SAML - #1998
Conversation
tmaguire
left a comment
tmaguire
left a comment
There was a problem hiding this comment.
This fixes issues when using Azure AD as a SAML idp with BookStack (I've had issues where if a user is already logged into Azure AD, they then can't log into BookStack, they've had to log out and then log back in).
Added tests to cover. Changed default to align with existing default. Added env option parsing. For #1998
|
Thanks for this @ivir and sorry for my very very late response, Detailed SAML/Auth issues can be a pain to understand and test. This is now merged, to be in the next patch release, after some tweaks in 9cf4191. I could not get any error or unexpected scenario to occur on my instance of Azure AD but I think it may depend on the exact AD setup and user authentication mechanisms use. For my own reference: |
3 participants
With default SAML configuration wasn't possible use Windows Authentication via AD FS and everytime is offered only login via AD FS form. That is due missing 'requestedAuthnContext' set to false when
IDP choose available method. Instead of that is send request with "'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" which on AD FS force to use form.
I just use setting from onelogin/php-saml/advanced_settings and provide configuration to .ENV file