[GUACAMOLE-1780] TOTP and SAML auth cannot be used together

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Done
• Fix Version/s: 1.6.0
• Component/s: guacamole, guacamole-auth-saml, guacamole-auth-totp
• Assignee: Unassigned
• Reporter: James Muehlner
• Created: 26/Apr/23 23:52
• Updated: 31/Oct/23 21:21
• Resolved: 31/Oct/23 21:21

Description

An authentication attempt using both the SAML and TOTP auth providers together cannot succeed. Depending on the order that the extensions are loaded, the behavior may be an infinite loop between SAML provider redirects and TOTP codes, or the login attempt will just fail after both factors are provided.

The problem seems to be that both SAML and TOTP have replay attack preventions in place - meaning that after the SAML response is accepted, and the TOTP prompt is submitted, the original SAML response is no longer valid.