SAML SSO only works on the main login page of the admin UI. It should work everywhere.

The SAML SSO feature (introduced in Core Fix 19) does not work for example on custom DSP homepages of custom packages. Or any other page in the normal admin UI. Those are pages that people have bookmarked. But if you directly jump to those pages then the browser will popup a login dialog.

This is especially true/bad for users that only have access to those custom DSP pages, but not to the Admin UI - because they are not Administrators. The custom DSPs are mostly for business users here.

There are workarounds, but those require code changes and configuration in the packages that provide the DSP pages and they have other downsides. For example, if you have logged in with SSO on Page A, you cannot go to Page B afterwards and other weird behavior (see "additional details" section for more details on that)

What we propose is to keep the SAML SSO configuration centralized. Use the "samlsso.cnf" file not only for the admin UI start page, but let us add the URLs of any other custom page in there to centralize the configuration. If the users jumps to a IS page and there is not already a session ID, and there is no basicAuth header in the request, nor is there a JWT or,..... then the next step should be to check, if the requested URL is configured as a SAML SSO URL. If so, then redirect to the IDP.

But if there already is a session ID then let the user in (the Admin main page does currently not do that, unless you add "#/reuseAuth" to the URL)

Because of DORA regulations we have to require all users to use MFA (by SAML SSO) to login to IS by the end of the year, and as it is right now it is very cumbersome, especially for non-admin users.

Cheers,

Frank