RO Single Sign On

Bypass Multi-factor Authentication on Single Sign On Login

The Identity Provider should take care of all login features such as password, TOTP, Passkey or any other authentication option. The Service Provider takes care of the authorization.

The IDP and SP relationship

The SP (Service Provider) has a trusted connection with the IDP (Identity Provider). The IDP takes care of the authentication and the SP should take care of the authorization; what users are allowed to do and see. 

Users manage their login account at the IDP, they setup whatever MFA they want to use from the list of available MFA options at the IDP.

Bypass Multi-factor Authentication on Single Sign On Login

Using RO Single Sign On it is possible to bypass the Multi-factor Authentication on Single Sign On login. To do that, the following configuration needs to be applied. This option is available from Joomla 5.3.4 forward.

  1. Login on the administrator side of the website
  2. Go to Users -> Manage
  3. Click on the Options in the toolbar
  4. Click on the Multi-factor authentication tab
  5. Scroll down to find the option Multi-factor Authentication after silent login
  6. Set this to No
  7. In the option Silent login authentication response types (for experts) add the word samlsilent to the existing list. Make sure it is comma-separated.
  8. Save the changes

Users who login with Single Sign On will not be presented the Mutli-factor challenges but regular logins will be.

Bypass Multi-factor Authentication on Single Sign On Login

Using the IDP as an SP

In case the IDP also acts as an SP, the Silent login authentication response types (for experts) should be extended with the word saml. So the full string then looks like cookie, passwordless,samlsilent,saml.