Force External Identity Provider to Reauthenticate

Questions
1

I have a requirement where our users need to reauthenticate with their saml2 external identity provider everytime they log into our angular application. We are using the classic engine.

Expected workflow:

  1. user1 goes to our application
  2. presses single sign on button
  3. navigated to okta site
  4. user1 enters email
  5. okta routes to identity provider via routing rules based on email
  6. user1 logs into identity provider
  7. user1 is redirected to application and logged in
  8. user1 logs out of application
  9. user2 repeats steps 1-8 on same device / browser

we’re experiencing when user2 is routed to the identity provider, user1’s session is still active so user2 is not given the change to login and they are instead redirected back to our application and logged in as user1.

I have attempted several methods without success:

  1. create a policy at Security → Authentication → Sign On tab that sets maximum session lifetime and maximum session idle to their lowest value of 1 minute
  2. create a policy at Applications → Applications → MyApp → Sign On tab where ‘Prompt for re-authentication’ is checked and set to its lowest value of 1 minute
  3. append uri parameters to individual identity provider uri strings at Security → Identity Providers → MyProvider → Actions → Configure Identity Provider. append ‘?prompt=login’ or ‘ForceAuthn=true’ or ‘?max_age=0’ to the "IdP Single Sign-On URL and “Destination”
  4. within our angular application, attempt to add the ‘prompt=login’ or ‘ForceAuthn=true’ or ‘maxAge=0’ parameters to our token.getWithRedirect call, tried signInWithRedirect with the added params, attempted to add them to our OktaAuth object.
  5. within our angular application, whenever the user logs out of our application, a clearsession call is sent and tokenmanager.clear is also called. have also tried calling signout

any insight or suggestions would be greatly appreciated.

2

looks like this might not be supported per this comment back in 2023. is that still the case? if so, could someone provide a starting point for a custom solution?