Is ForceAuthn=true good idea for Service Provider

user_1711762 0
Viewed 2457

Looking for guidance to understand the use case behind ForceAuthn=true for SAML-driven Single Sign-On.

We know that ForceAuthn=true will always challenge the user for credentials which creates friction thus negative experience for the user.

However, that's UX story. What about security?

If ForceAuthn=false, I authenticate once and the second time a seamless login will happen.

This might create an issue where unware user using public PC can leave the access open for the next person.

If you have are (or work) for a provider (e.g. SaaS) and have SAML-driven SSO with clients, what is your policy/experience around this topic?

saml-2.0 authentication security
1 Answers

It's not common for service providers to set ForceAuthn=true. As the service provider, it's not your decision on how to authenticate a user when you are entrusting that process to the identity provider. And, what happens when the IdP is using a non-interactive authentication mechanism like Kerberos? While they may see the redirects occurring, there's no user interaction with or without forcing authentication. Point being, if you're outsourcing authn, then outsource it, and then have the IdP indemnify you for anything around authentication.

What I do see service providers doing is using ForceAuthn=true to use as "singular transaction authorization" like for authorization of steps in workflows and digital signing.

user_29465630
Related