Conditionally Force Login with SAML Connections

This article clarifies whether it is possible to force the user to enter credentials at the upstream Identity Provider (IdP) and to conditionally set ForceAuthn=true in the SAML Request, but only when required and not all the time.

• SAML Connection
• Identity Provider (IdP)

It is not possible to conditionally set ForceAuthn=true in the SAML AuthnRequest today. If it is set in the template, it applies to the whole connection. If chosen to implement it this way, note that the users will be prompted to log in each time they go to the upstream IdP. The user can still silently renew the tokens using the existing Auth0 session.