Login not shown if logged in a non-application user

userAik5 0
Viewed 85

Good evening,

I faced the following issue when I was logged in with my Azure AD user and I wanted to open my web application which uses SAML against Azure AD: the login page wasn't shown but I got an error saying

R
Sorry, but we’re having trouble with signing you in.

AADSTS50105: Your administrator has configured the application XXX to block 
users unless they are specifically granted ('assigned') access to the application.
The signed in user 'XXXXXXXXXXXXX.onmicrosoft.com' 
is blocked because they are not a direct member of a group with access, nor had 
access directly assigned by an administrator. Please contact your administrator 
to assign access to this application.

That's okay but I'd expect to see the log in page so I could type my application user and password to enter my application. Instead I couldn't log in at all as all I can see this error when tried to enter my web application. I had to remove the cookies to be able to see the login page again.

I am pretty sure there is a way to handle this scenario (when a user is logged in which doesn't have permission for the specific application), I just don't have the knowledge what/where to set.

Could you please help?

Thanks!

azure-active-directory
1 Answers

I tried the same in my environment and got the below results:

I created a web application which uses SAML against Azure AD like below:

enter image description here

I assigned a user to the SAML Application like below:

enter image description here

When I tried to login with the non-assigned user using User access URL, I got some error without any Login screen/prompt like below:

enter image description here

To resolve the error, try adding ForceAuthn="true" parameter value in the SAML authentication request.

  • The ForceAuthn="true" parameter must be added on the application side and the SAML request not on the app registration side.
<samlp:AuthnRequest....
ForceAuthn="true"....
</samlp:AuthnRequest>

After adding the above value, you will be able to get the Login prompt for all the users like below:

enter image description here

When I tried to login with the assigned user, I was able to get the redirected page successfully like below:

enter image description here

Please note that, for SAML Azure AD sets ForceAuthN value as False on first login. This parameter forces the interactive login/force reauthentication for all the users.

Reference:

Define a SAML technical profile in a custom policy - Azure AD | Microsoft Docs

Rukmini0
Related