firebase / firebase/firebase-js-sdk

TOTP MFA prevents SAML claims from populating in ID token

Open
#8,249 0 comments 0 reactions 0 assignees View on GitHub
api: auth needs-attention question stack:NextJS
Dominant language
TypeScript
Stars
5.1k
Forks
1k
Avg merge
2d 21h
Merged PRs (30d)
37

Description

### Operating System

Mac OS 14.2.1 (23C71)

### Browser Version

Chrome/124.0.6367.119

### Firebase SDK Version

10.12.0

### Firebase SDK Product:

Auth

### Describe your project's tooling

React Next.js SPA

### Describe the problem

When I enable TOTP MFA for a tenant, SAML claims are no longer populated in the JWT for a signed in user.

### Steps and code to reproduce issue

1. Create Google Identity Platform Project
2. Enable multitenancy, create tenant
3. Enable TOTP MFA for tenant via admin-sdk
4. Add SAML provider to tenant (used Entra ID in my case)
5. Make React application, add `firebase` as dependency
6. Set up TOTP MFA enrollment and sign in flows
7. Initiate SAML redirect sign in flow
```typescript
signInWithRedirect(auth, new SAMLAuthProvider(""))
```
8. Be prompted to enroll in MFA (At this point the JWT does contain SAML claims)

![image](https://github.com/firebase/firebase-js-sdk/assets/43415278/6586c10b-4212-4ead-b8ee-f681ed0d71df)

9. Complete enrollment

10. Print `UserImpl`, decode JWT
```json
{
"iss": "",
"aud": "",
"auth_time": 1715792567,
"user_id": "",
"sub": "",
"iat": 1715792567,
"exp": 1715796167,
"email": "",
"email_verified": true,
"firebase": {
"identities": {
"saml.cyvidia-entra-id": [
""
],
"email": [
""
]
},
"sign_in_provider": "saml.cyvidia-entra-id",
"sign_in_second_factor": "totp",
"second_factor_identifier": "c2393de3-646f-45c5-aade-5ade10bc203e",
"tenant": "customer-1-p2kfv"
}
}
```

11. Log out, log back in
12. Print `UserImpl`, verify that JWT still does not contain claims
13. Disable TOTP MFA using admin sdk
14. Log out, log back in
15. Print `UserImpl`, decode JWT
```json
{
"iss": "",
"aud": "",
"auth_time": 1715792890,
"user_id": "",
"sub": "",
"iat": 1715792890,
"exp": 1715796490,
"email": "",
"email_verified": true,
"firebase": {
"identities": {
"saml.cyvidia-entra-id": [
""
],
"email": [
""
]
},
"sign_in_provider": "saml.cyvidia-entra-id",
"sign_in_attributes": {
"http://schemas.microsoft.com/identity/claims/displayname": "",
"http://schemas.microsoft.com/identity/claims/tenantid": "",
"http://schemas.microsoft.com/identity/claims/identityprovider": "",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "",
"http://schemas.microsoft.com/claims/authnmethodsreferences": [
"http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password",
"http://schemas.microsoft.com/claims/multipleauthn"
],
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": ""
},
"tenant": "customer-1-p2kfv"
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.