SPNEGO login flow: Enforce SPNEGO by condition

[Daniel Lutz]

Chris Phillips schrieb am 01.12.15 um 17:35:
> Regarding '..If it's OK that all users need to opt-in for SPNEGO once, the
> current
> implementation should work for you.'
> 
> Is this opt-in 'forever' or is it time bound?
> 
> From a risk management standpoint, I hope it's time bound and configurable
> so that the amount of risk I want to bear is 'configurable' or at least
> evident somewhere. 

The auto-login cookie is set by a common cookie management component
of the IdP. The lifetime of these cookies can be set by the
global property "idp.cookie.maxAge" in conf/idp.properties. The default
value is one year (31536000).

As the current implementation makes use of the common cookie management
component, it's currently not possible to specify an individual lifetime
for the SPNEGO auto-login cookie.

> On this item:
> "If IE gets an SPNEGO request, but Kerberos is not available on the
> client (or IE is not configured appropriately), the IdP (Shibboleth)
> doesn't get a chance to show an error message. Before returning to
> the IdP, IE will show a username/password login window (which would
> allow to log in using NTLM instead of Kerberos)."
> 
> Uhg! That is ugly..
> 
> 
> As I try to better understand things, what is the context of the client in
> this case? 
> I'm thinking of a case where a user has authenticated to their laptop on
> the corporate/institutional network and signs in.
> I can see this working just as expected in the flows.
> 
> However, the one I think is more challenging is:
> User signs into a laptop that has been joined to the AD domain and THEN
> attempts to sign in while on the road outside the corporate/institutional
> network.  Is this flow able to successfully complete as if it were on the
> institutional LAN?

In this situation, the flow wouldn't complete. The browser can't get a
service ticket for the IdP from the KDC.

In case of Firefox/Safari etc., the flow can handle the error
and fall back to the Password login flow (and show an appropriate
error message). In case of IE, IE might fall back to NTLM and not
return to the IdP. To avoid this, an activation condition should be
configured that detects that the user is not in the
corporate/institutional network. The acitvation condition would
disable the SPNEGO login flow for this client.

(In case a service ticket for the IdP exists from a previous
login attempt while having been in the corporate/institutional network,
SPNEGO may succeed, depending on the validity of the Kerberos
tickets.)

> I'm just trying to exercise and understand to what extent that SPNEGO can
> work for users and what the requirements or perimeter of utility it
> affords an IdP who implements. (e.g. In order for SPNEGO to work must
> device be on the institutional LAN somehow?)
> 
> Tell me if I am accurate on these statements about SPNEGO's flow :
> - SPNEGO can be enabled and users can self opt-in

Yes, that's true. Users can self opt-in via the Password login flow's
login page. (This requires that the SPNEGO login flow is set up
as an "extended login flow".)

> - said users MUST be on the institution LAN where the KDC is 'reachable'

Yes. The client must be able to get a service ticket for the IdP
from the KDC. (If the client already has such a ticket, it may
still work outside the institution LAN, as long as the service
ticket is still valid. But you can't rely on this.)

> - the moment users attempt to use SPNEGO outside said network where the
> KDC is unreachable, they must use password authentication

Yes. Then, SPNEGO usually doesn't work. An activation condition should
be setup that disables the SPNEGO login flow in this case.
(The activation condition would check for the client's IP address.)

> - password authentication will be automatically offered in such cases
> (regardless of browser)

Yes. In the default configuration, the SPNEGO login flow falls back
to the next flow, which is the Password login flow in a usual
deployment). The SPNEGO login flow is only directly run if the
auto-login cookie is set.

> - users will have to only opt-in once for said behaviour to work (SPNEGO
> on LAN, password auth outside LAN)

Yes. Opting in will set the auto-login cookie, which is a permanent
cookie that keeps valid for the specified lifetime (according to
the global property "idp.cookie.maxAge").

> Am I in the right frame of mind based on the above?

Yes, I think so.


-- Daniel