WebAuthN MFA with SAML Fails (Keycloak v23.0.6)

Getting advice
1

In my use-case we are using a SAML client to log in on our application. Everything works fine without MFA credentials being stored and used. We are testing adding both OTP and WebAuthN as MFA options. The OTP flow works fine to register and sign-in. The SAML assertions are built and passed through just like in our flows without MFA.

However, using WebAuthN does not seem to work for some reason. Requiring a user to set up WebAuthN on login works fine as this is just the registration process. The SAML assertions are built and passed successfully after username/password entry and WebAuthN registration.

Upon trying to use the WebAuthN credential on the subsequent sign-in the SAML assertion fails to fully build, resulting in our system erroring out.

The SAML assertion when intercepted shows:

<samlp:Status>
  <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:RequestDenied" />
  </samlp:StatusCode>
</samlp:Status>

With the Keycloak error stating things like error="rejected_by_user" and web_authn_authentication_error="webauthn-error-user-not-found":

2025-03-27 04:06:31,233 WARN [org.keycloak.events] (executor-thread-80) type="LOGIN_ERROR", realmId="8e87efd9-21cb-4031-adb3-0b79c4d47ce3",
clientId="realm-saml", userId="null", ipAddress="", error="rejected_by_user", credential_type="webauthn", auth_method="saml",
web_authn_authentication_error="webauthn-error-user-not-found", web_authn_authenticated_user_id="9fbd91c5-9487-45ee-86ce-a5ecf825b047", redirect_uri="https://serverName/login/saml2/sso/realm-saml", code_id="c8cd6152-df20-4da5-a766-960fa8dda353"

The error above doesn’t exactly make sense though given we completed the WebAuthN check so it was not “rejected_by_user” technically and the user with that ID does exist as I just got past the username and password section successfully for that user.

This is the basic test flow we are using with just WebAuthN in the browser flow. Note, we have also tried removing the role condition check and just having username/password with the next step being an enforced WebAuthN check and this has the same issue.

Browser_with_WebAuthN
Browser_with_WebAuthN2987×1768 234 KB

We have tried different forms of WebAuthN and setting the Relying Party ID and Name to our frontend URL base host name but those did not help.

If anyone has some insight it would be appreciated.

2

To cut SAML out the picture for debugging, does WebAuthN login to the account console work?

3

@bpedersen2 I tested and yes WebAuthN with that flow above works to log into the account console for that realm. But once I move to SAML there is the issue.