Rocket.Chat SAML Login Fails with Entra ID When Using Non-Password Authentication Due to Enforced RequestedAuthnContext

Description:

We are using Rocket.Chat server and do authentication via SAML and Microsoft Entra ID. When we try to logon with Entra ID and use password login everything is fine. However, when the user changes the authentication method and selects, e.g., "Use an app instead" the logon fails. The Rocket.Chat server in its SAML request restricts to "Password" and so the Entra ID logon cannot succeed when any other authentication method than password is used.

Steps to reproduce:

1. Use default SAML configuration that comes with Rocket.Chat server and connect a M365 Tenant via Entra ID.
2. Login to Rocketchat using the SAML provider. In Entra ID authentication use option "Use an app instead" and authenticate via Microsoft Authenticator App on smartphone.
3. After authentication via Microsoft Authenticator App the error is shown in Entra ID: "AADSTS75011: Authentication method 'MultiFactor, PasswordlessPhoneSignIn' by which the user authenticated with the service doesn't match requested authentication method 'Password, ProtectedTransport'. Contact the rocketchat.my.domain application owner."

Expected behavior:

The default SAML configuration in Rocket.Chat server should not enforce "Password" logon and thus should allow other logon methods as well when using SAML. So when using Rocket.Chat server with its default configuration and together with SAML you are able to logon with modern authentication methods and not only with password.

Rocket.Chat server sends "RequestedAuthnContext" in the SAML Request to Entra ID. This is an optional value in the SAML request. If this could just be removed or replaced with the "Unspecified" method the logon should succeed.

Actual behavior:

Logon via "PasswordlessPhoneSignIn" fails. See screenshot.

Server Setup Information:

• Version of Rocket.Chat Server: 7.12.0
• License Type: Community Edition
• Number of Users: 40
• Operating System: Ubuntu 22.04
• Deployment Method: snap
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Client Setup Information

• Desktop App or Browser Version: Google Chrome Version 141.0.7390.122 (Official Build) (64-bit)
• Operating System: Windows 11 Pro

Additional context

It looks like that new options have been created in #16713. However, changing SAML options requires a paid plan for Rocket.Chat. While customizing SAML could stay a paid option, you could change the default SAML config so that modern authentication methods with Entra ID work by default.

Relevant logs:

none

Start by locating the default SAML configuration and the code that adds RequestedAuthnContext to the SAML request; review issue #16713 for related SAML options. Done means the default request no longer enforces Password and both password and passwordless Entra ID authentication paths are supported.