Force account picker with SAML login

Question

Hello,

I'm using SAML integration for my GitHub Enterprise account. Is there a possibility to force account picker during SSO flow with SAML?

With OIDC I can append prompt=select_account -- is a similar feature also available for SAML?

THank you,

Manuel

Answer 1

@Manuel Linsmayer

Thank you for posting this in Microsoft Q&A.

As I understand you are looking for replacement of OIDC property "prompt=select_account" in SAML protocol.

Unfortunately, there is no option similar to OIDC's prompt=select_account in the SAML protocol for Microsoft Entra ID.

https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8168_1983180497

As a solution, you might consider using the ForceAuthn parameter or have the SP obtain the UPN in advance and send the request with the login_hint parameter attached.

But "ForceAuthn" parameter is a boolean value that needs to be set. If it is set to true, it means that the user will be forced to reauthenticate, even if they have a valid session with Microsoft Entra ID.

However, on every prompt it gives the page to select an account to be logged in.

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.