SAML SSO Fails for certain types of Azure AD USers

[TheMacStack]

Hello

We have Sentry deployed in Docker and SSO configured using the Generic SAML2 plugin and an Enterprise Application in Azure AD.

It works perfectly for Local AAD Users but for B2B accounts in Azure AD it fails.

After discussing with MS they are claiming that the value classes:PasswordProtectedTransport

in the SAML Request is not supported on their side and causes inconsistent behavior and we should have it changed to classes:Password unless there is some specific use case for classes:PasswordProtectedTransport.

extract from SAML request

    <samlp:RequestedAuthnContext Comparison="exact">

        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>

    </samlp:RequestedAuthnContext>

I understand you may be hesitant to make such a change due to how it may effect the many other users but can you maybe provide some guidance on how we can make that change if we were to fork and maintain a fork of this project?

I did have a dig through the source code but I am not very familiar with SAML so was not able to find anything that seemed relevant.

thanks

[evanpurkhiser]

I recently made a similar change, which may help: getsentry/sentry#12875

[TheMacStack]

Thanks @evanpurkhiser that does help.

Would it make sense to add classes:Password to that same list? I dont understand how it is iterated through or which is selected etc so that may be nonsense.

eg:

        'requestedAuthnContext': [
            'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
            'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
            'urn:federation:authentication:windows',
        ],

[jeffersonluismartins]

I need to configure the SAML (Generic Saml2 plugin of this repository), however, I'm not finding the URLs, SLS, ACS and Metadata. Could you help me, please?

[evanpurkhiser]

Hi @jeffersonluismartins: Please see https://docs.sentry.io/accounts/sso/#saml2-identity-provider

Also please remember that GitHub issues are not a place for support, but rather the Sentry Forums are

[jeffersonluismartins]

No problem, @evanpurkhiser.
I read the document and installed the plugin getsentry/sentry-auth-saml2, but everytime that I try to get the url ACS, SLS and metadata (as specified in the document), the console returns to the homepage (https://mydnssentry.com/organization).
I'll open the ticket on the Forum's Sentry, anyway.
Thank you so much!