New/feature/saml mfa strategy

[maravedi]

Pull Request

Summary

This PR addresses the AADSTS75011 error encountered by Entra ID (Azure AD) users authenticating via SAML with MFA, smartcards, or FIDO2. The issue stems from LibreChat's passport-saml strategy explicitly requesting a Password or ProtectedTransport authentication context with an "exact" comparison, which conflicts with stronger authentication methods provided by Entra ID.

This change introduces a new environment variable, SAML_DISABLE_REQUESTED_AUTHN_CONTEXT, which, when set to true, disables the RequestedAuthnContext element in the SAML AuthnRequest. This allows Entra ID to satisfy the authentication request with any valid, stronger method, resolving the AADSTS75011 error without compromising security.

Change Type

Please delete any irrelevant options.

• New feature (non-breaking change which adds functionality)

Testing

Please describe your test process and include instructions so that we can reproduce your test. If there are any important variables for your testing configuration, list them here.

Test Configuration:

Checklist

Please delete any irrelevant options.

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• Local unit tests pass with my changes