TFA causing break in saml Registration/login acoount link flow

[grohitg238]

Hello experts,

We have TFA configured for every login from different device/country. now we are implementing sso with external idp using SAML. where we are facing issue with account linking for saml user.

case is, if user is already have site identity at CDC, when user tries to use saml sign in option from different device there will be identity conflict & cdc triggers account link flow.

now because of TFA required for the account which is trying to link saml user is not supported, this is also mentioned in cdc documentation.

1. To make the linking happen, we have to disable the TFA which is not serving purpose of configuring it at first.

2. If we chose option by not linking two identities, CDC is asking for TFA two time within one device for same user.

Is there any alternative in option 1 apart from option 2?

Thanks.

Rohit

[igal_mi · Accepted solution]

Hi Rohit,

My suggestion is:

1. Create a separate apikey (within the same site group) to handle SAML logins.
2. In RBA, Exclude this apikey from the TFA rule.
3. point SAML logins to a page that runs under this apikey.

With this setup in place:

1. User logs in via SAML
2. They are prompted with account linking.
3. They perform account linking successfully (No TFA required as it's excluded from this apikey)
4. They SSO to the main application (original apikey)
5. As part of the SSO, the platform will prompt for TFA
6. They pass TFA process and successfully log it to the application.

Hope this makes sense.

Igal