firebase / firebase/firebase-js-sdk
TOTP MFA prevents SAML claims from populating in ID token
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### Operating System
Mac OS 14.2.1 (23C71)
### Browser Version
Chrome/124.0.6367.119
### Firebase SDK Version
10.12.0
### Firebase SDK Product:
Auth
### Describe your project's tooling
React Next.js SPA
### Describe the problem
When I enable TOTP MFA for a tenant, SAML claims are no longer populated in the JWT for a signed in user.
### Steps and code to reproduce issue
1. Create Google Identity Platform Project
2. Enable multitenancy, create tenant
3. Enable TOTP MFA for tenant via admin-sdk
4. Add SAML provider to tenant (used Entra ID in my case)
5. Make React application, add `firebase` as dependency
6. Set up TOTP MFA enrollment and sign in flows
7. Initiate SAML redirect sign in flow
```typescript
signInWithRedirect(auth, new SAMLAuthProvider(""))
```
8. Be prompted to enroll in MFA (At this point the JWT does contain SAML claims)

9. Complete enrollment
10. Print `UserImpl`, decode JWT
```json
{
"iss": "",
"aud": "",
"auth_time": 1715792567,
"user_id": "",
"sub": "",
"iat": 1715792567,
"exp": 1715796167,
"email": "",
"email_verified": true,
"firebase": {
"identities": {
"saml.cyvidia-entra-id": [
""
],
"email": [
""
]
},
"sign_in_provider": "saml.cyvidia-entra-id",
"sign_in_second_factor": "totp",
"second_factor_identifier": "c2393de3-646f-45c5-aade-5ade10bc203e",
"tenant": "customer-1-p2kfv"
}
}
```
11. Log out, log back in
12. Print `UserImpl`, verify that JWT still does not contain claims
13. Disable TOTP MFA using admin sdk
14. Log out, log back in
15. Print `UserImpl`, decode JWT
```json
{
"iss": "",
"aud": "",
"auth_time": 1715792890,
"user_id": "",
"sub": "",
"iat": 1715792890,
"exp": 1715796490,
"email": "",
"email_verified": true,
"firebase": {
"identities": {
"saml.cyvidia-entra-id": [
""
],
"email": [
""
]
},
"sign_in_provider": "saml.cyvidia-entra-id",
"sign_in_attributes": {
"http://schemas.microsoft.com/identity/claims/displayname": "",
"http://schemas.microsoft.com/identity/claims/tenantid": "",
"http://schemas.microsoft.com/identity/claims/identityprovider": "",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "",
"http://schemas.microsoft.com/claims/authnmethodsreferences": [
"http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
"http://schemas.microsoft.com/claims/multipleauthn"
],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": ""
},
"tenant": "customer-1-p2kfv"
}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.