SPNEGO login flow: Enforce SPNEGO by condition

[Chris Phillips]

Thanks for surfacing this use case Daniel.
+1 for exploring the way to support this!

As you call out the IE experience, you are essentially offering the user
to either click 'login with password' OR 'login with Kerberos
credentials'(or some friendlier variation of text) right?

What's the behaviour once the IE user has chosen SPNEGO method for sign on
at least once?
Will they have been tagged with a cookie to indicate this selection for
the duration of the shibboleth session? Duration of the lifetime of a
cookie? (days/weeks?)


An area I'm  hopeful this use case will help is Sharepoint SAML
integration when using the office apps (powerpoint/word/excel) as the user
signs in (password) via a browser, then launches these apps and then forms
authentication kicks in again and the user signs in again with password.
I agree it's as if they changed browsers midstream but I'm hopeful that
with SPNEGO login we can at least see the 'use kerberos credentials'
button if not just automatically use it.  My reservation though is that
these office apps are going to appear equivalently to IE and therefore not
have as graceful behaviour as the first use case which reliably detect
failures.

BTW, what happens in a failed SPNEGO detection state that IE has?  Does it
show an error page in Shibboleth?  If so -- maybe one could tweak that
page to improve the user flow -- but maybe you've already thought about
that?

C.


On 2015-12-01, 7:28 AM, "dev on behalf of Daniel Lutz"
<dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:

>The current implementation of the SPNEGO login flow doesn't
>directly support the use case described in the thread
>"SPNEGO, 3.2, ActivationCondition and SPNEGO-button on login.vm"
>on the user at shibboleth.net list.
>
>The use case is:
>- For all browsers except IE (e.g. Firefox and Safari), always try
>  (i.e. enforce) SPNEGO login. If it fails, fall back to Password login.
>  (The user should not need to opt-in for SPNEGO.) For browsers other
>   than IE, the SPNEGO login flow can reliably detect failures.
>- For IE, only try SPNEGO if auto-login is enabled. Else, fall back
>  to the Password login flow. On the login flow, allow the user to
>  log in using SPNEGO (by running SPNEGO as an extended flow).
>
>The current implementation of the SPNEGO login flow doesn't support
>this, mainly because it's not possible to enforce SPNEGO depending
>on the client.
>
>I think that it's reasonable to support this use case. In my initial
>implementation of the flow, I didn't think of this use case.
>
>I propose to change the behavior of the flow regarding the
>"EnforceRun" option:
>
>Instead of restricting this option to a pre-configured fixed value,
>the deployer should have the possibility to define the "EnforceRun"
>option as a predicate, e.g. as a ScriptedPredicate. This way, the deployer
>can influence the "EnforceRun" behavior during runtime.
>
>What do you think about this proposal? Would this be a feasible option?
>Or do you expect any unwanted side effects?
>
>(Before I start working on an implementation, I would like to hear
>your opinion.)
>
>-- Daniel
>-- 
>To unsubscribe from this list send an email to
>dev-unsubscribe at shibboleth.net