Add SSO setting to skip local MFA

Feature requests
1

As admin I want to disable MFA for the SSO login so that users can use the identity providers MFA without weakening the local authentication process.

Q1. What is the problem that you are trying to solve?
When using SSO with OpenID, users have to continue to pass the local Passbolt MFA step. Usually, the identity provider takes care of the MFA. In our case we enforce MFA on the identity provider side (Keycloak). Therefore it would be useful to have an admin setting to allow users to skip the local MFA. We still want to keep the local MFA step in case the local login (password) is being used.

Q2 - Who is impacted?
Users using OpenID as Single Sign On that have MFA activated.

Q3 - Why is it important and/or urgent?
This would increase the acceptance for Single Sign On and support stronger authentication, for example with FIDO2. At the same time the local authentication is not weakened as MFA is still enabled when using the passphrase login.

Q4 - What is your proposed solution? (optional)

  • Add a setting “Skip local MFA” in /app/administration/sso
  • If the setting is set, skip the MFA (for example TOTP) step if users use OpenID connect when logging in
  • Keep MFA step when users log in with passphrase (fallback)
2 Likes
2

G’day Sven.

We have a task I’ve added your request to as I believe they are the same.

PB-39101 “EPIC - SSO As a logging-in user with SSO, I want MFA to be deactivated but kept for passphrase authentication”

For anyone ‘following along at home’ it’s worth mentioning that passbolt is MFA by default as the private key + passphrase is the “thing you have” and the “thing you know”.

But I agree, great feature improvement.

Thanks for taking the time to post and I hope that you keep letting us know what features you’d like to see.

Cheers
Gareth

1 Like