SPNEGO login flow: Enforce SPNEGO by condition

[Cantor, Scott]

On 12/1/15, 7:28 AM, "dev on behalf of Daniel Lutz" <dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:



>The current implementation of the SPNEGO login flow doesn't support
>this, mainly because it's not possible to enforce SPNEGO depending
>on the client.

No, but you can set the cookie at runtime and then trigger it, basically turning off the forcing behavior up front.

>Instead of restricting this option to a pre-configured fixed value,
>the deployer should have the possibility to define the "EnforceRun"
>option as a predicate, e.g. as a ScriptedPredicate. This way, the deployer
>can influence the "EnforceRun" behavior during runtime.
>
>What do you think about this proposal? Would this be a feasible option?
>Or do you expect any unwanted side effects?

Implementing it compatibly will be a little tricky. Probably would need to wire in a fallback predicate set to alwaysTrue and override that if a user supplied one is available. You can't change what's already shipped or change the behavior of the existing options.

I'm not sure it's warranted since this is perfectly doable already using Javascript.

-- Scott