SPNEGO login flow: Enforce SPNEGO by condition

[Daniel Lutz]

The current implementation of the SPNEGO login flow doesn't
directly support the use case described in the thread
"SPNEGO, 3.2, ActivationCondition and SPNEGO-button on login.vm"
on the user at shibboleth.net list.

The use case is:
- For all browsers except IE (e.g. Firefox and Safari), always try
  (i.e. enforce) SPNEGO login. If it fails, fall back to Password login.
  (The user should not need to opt-in for SPNEGO.) For browsers other
   than IE, the SPNEGO login flow can reliably detect failures.
- For IE, only try SPNEGO if auto-login is enabled. Else, fall back
  to the Password login flow. On the login flow, allow the user to
  log in using SPNEGO (by running SPNEGO as an extended flow).

The current implementation of the SPNEGO login flow doesn't support
this, mainly because it's not possible to enforce SPNEGO depending
on the client.

I think that it's reasonable to support this use case. In my initial
implementation of the flow, I didn't think of this use case.

I propose to change the behavior of the flow regarding the
"EnforceRun" option:

Instead of restricting this option to a pre-configured fixed value,
the deployer should have the possibility to define the "EnforceRun"
option as a predicate, e.g. as a ScriptedPredicate. This way, the deployer
can influence the "EnforceRun" behavior during runtime.

What do you think about this proposal? Would this be a feasible option?
Or do you expect any unwanted side effects?

(Before I start working on an implementation, I would like to hear
your opinion.)

-- Daniel