When Does Okta Honor Force Authentication in a SAML Application

The Honor Force Authentication setting in a Security Assertion Markup Language (SAML) application determines whether the Identity Provider (IdP) prompts users for authentication when an active session exists. Configuring this setting ensures that Okta enforces or ignores the ForceAuthn attribute sent during a Service Provider (SP) initiated login flow.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Custom SAML Application
• Honor Force Authentication

The need to honor force authentication can arise when an SP requires that users are re-authenticated with the IdP, even if there is already an existing active session. 

How does the ForceAuthn attribute function?

With SAML, the ForceAuthn attribute ensures that the IdP prompts users for authentication again, even if an active session exists. The SP sends the attribute as part of the AuthnRequest during an SP-initiated login flow to the IdP. When the configuration sets the attribute to true, it forces the IdP to prompt the user for authentication, regardless of an existing session. If the configuration sets the attribute to false, the IdP may use an existing session to authenticate the user without prompting for another login. The Honor Force Authentication setting determines whether Okta enforces or ignores the ForceAuthn attribute.

What are the steps to configure Honor Force Authentication in Okta?

Navigate to the application settings in the Admin Console and modify the advanced SAML settings to configure the Honor Force Authentication requirement.

1. Navigate to Applications > Applications.
2. Select the <Custom SAML App name>.
3. Go to the General tab, locate SAML Settings, and select Edit.
4. Select Show Advanced Settings under the SAML Settings and scroll down to Honor Force Authentication.
5. Select Yes to require users to authenticate even if an active session exists, or select No to ignore the ForceAuthn attribute and permit the use of an existing session.