Windows HELLO for Business users logins are failing

[ricky-rockstar]

We are having SAML users failing to login, and on investigation we have identified that it is because they use Windows HELLO for Business

We have dug into the issue, and the only solution we can find is to manually remove the following lines from the AuthnRequest::__construct() constructor method

<samlp:RequestedAuthnContext $authnComparisonAttr>
        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>

We obviously don't want to manually make changes to your library so this ticket is to understand:

1. whether there is an option we are not aware of to enable users using Windows HELLO for Business to log in; or
2. you could release an enhancement which includes support for Windows HELLO for Business logins

Thanks so much!

[pitbulk]

Hi @ricky-rockstar, set requestedAuthnContext to false, that way the AuthNRequest will not contain the RequestedAuthnContext element.