While configuring SAML 2.0 Single Sign-On (SSO) for the Ceph Dashboard against Microsoft Entra ID (formerly Azure AD), standard password authentication works out of the box. However, the moment you authenticate with modern, phishing-resistant credentials—such as FIDO2 security keys, Windows Hello, or passwordless MFA—Entra ID rejects the login with AADSTS75011:
AADSTS75011: Authentication method 'MultiFactor, Fido' by which the user
authenticated with the service doesn't match requested authentication method
'Password, ProtectedTransport'. Contact the Ceph Dashboard application owner.
At first glance, the error seems backwards: authenticating with a FIDO2 hardware key and MFA is strictly more secure than a password, yet the Identity Provider blocks the session.
Here is why this happens in Ceph and how to fix it cleanly in the Ceph monitor configuration store without patching Python files inside the ceph-mgr container.
Why It Happens: python-saml and RequestedAuthnContext
Under the hood, the Ceph Dashboard relies on OneLogin's python-saml library to act as a SAML Service Provider.
By default, python-saml initializes its security configuration with:
'requestedAuthnContext': True
Unless overridden, every outbound AuthnRequest generated by the Ceph Dashboard includes an explicit <samlp:RequestedAuthnContext> block demanding PasswordProtectedTransport with Comparison="exact":
<samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef>
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
Because Comparison="exact" is enforced, Entra ID checks the exact authentication method used to satisfy the session. When a user signs in with a passkey/FIDO2 token or MFA, Entra ID records the session context as MultiFactor, Fido. Since that does not literally match Password, ProtectedTransport, Entra ID aborts the SAML flow with AADSTS75011.
To allow FIDO2, passkeys, and MFA, Ceph needs to omit <samlp:RequestedAuthnContext> from its AuthnRequest and let Entra ID's Conditional Access policies govern acceptable authentication methods.
The Fix: Updating ssodb_v1 in the Monitor Store
The ceph dashboard sso setup saml2 CLI command does not expose a flag to toggle requestedAuthnContext, and inspecting ceph dashboard sso show saml2 will show it enabled by default:
$ ceph dashboard sso show saml2 | jq '.onelogin_settings.security.requestedAuthnContext'
true
Instead of modifying sso.py on the container filesystem—which would be wiped on the next container restart or Ceph upgrade—we can patch the serialized SSO database (mgr/dashboard/ssodb_v1) directly in the Ceph monitor config-key store.
1. Export the Current SSO Configuration
Dump the raw JSON configuration from the monitor store:
ceph config-key get mgr/dashboard/ssodb_v1 > ssodb.json
2. Disable requestedAuthnContext Under .saml2
Ceph stores SAML 2.0 settings under .saml2.onelogin_settings. Use jq to set both requestedAuthnContext and failOnAuthnContextMismatch to false inside .saml2.onelogin_settings.security:
jq '.saml2.onelogin_settings.security += {
"requestedAuthnContext": false,
"failOnAuthnContextMismatch": false
}' ssodb.json > ssodb_updated.json
Verify the updated security block before applying it:
$ jq '.saml2.onelogin_settings.security' ssodb_updated.json
{
"nameIdEncrypted": false,
"authnRequestsSigned": false,
"logoutRequestSigned": false,
"logoutResponseSigned": false,
"signMetadata": false,
"wantMessagesSigned": false,
"wantAssertionsSigned": false,
"wantAssertionsEncrypted": false,
"wantNameIdEncrypted": false,
"metadataValidUntil": "",
"wantAttributeStatement": false,
"requestedAuthnContext": false,
"failOnAuthnContextMismatch": false
}
3. Write the Configuration Back and Reload the Dashboard
Write the updated JSON back to mgr/dashboard/ssodb_v1:
ceph config-key set mgr/dashboard/ssodb_v1 -i ssodb_updated.json
Reload the dashboard manager module so ceph-mgr picks up the new settings from the monitor store:
ceph mgr module disable dashboard
ceph mgr module enable dashboard
Confirm that the active SAML configuration now reflects false:
$ ceph dashboard sso show saml2 | jq '.onelogin_settings.security.requestedAuthnContext'
false
Persistence and Operational Notes
With requestedAuthnContext disabled, SP-initiated logins to the Ceph Dashboard omit the <samlp:RequestedAuthnContext> constraint, allowing Entra ID to complete authentication using FIDO2 security keys, Windows Hello, or MFA without triggering AADSTS75011.
Because the configuration lives in the Ceph monitor database (config-key), it persists across ceph-mgr failovers, container restarts, and node reboots. The only caveat to keep in mind is that running ceph dashboard sso setup saml2 in the future (for instance, when rotating IdP signing certificates) will regenerate the .saml2 dictionary and reset requestedAuthnContext to true—so keep this jq patch in your cluster runbook or configuration management whenever SAML metadata is re-imported.