SPNEGO login flow: Enforce SPNEGO by condition

[Cantor, Scott]

On 12/1/15, 11:17 AM, "dev on behalf of Daniel Lutz" <dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:



>On 2015-12-01 at 15:57, Cantor, Scott wrote:
>> Implementing it compatibly will be a little tricky. Probably would need to
>> wire in a fallback predicate set to alwaysTrue and override that if a user
>> supplied one is available. You can't change what's already shipped or
>> change the behavior of the existing options.
>
>Yes, I'm aware that this would require some tricky configuration to
>keep backwards compatible.
>
>> I'm not sure it's warranted since this is perfectly doable already using
>> Javascript.
>
>OK, then I will look for a solution based on JavaScript.

Specifically, check for the missing cookie and set it if the user agent matches in a script auto-run by the password form. The user won't see any difference.

Main point being it will work immediately with no software update.

-- Scott