SPNEGO login flow: Enforce SPNEGO by condition

[Chris Phillips]

Thanks for detailed reply on this Daniel..


When you refer to an activation condition to be setup and something
checking the client's IP address, I presume this to be something in the
flows on the IdP. I think it would be valuable to be a configuration
variable in the IdP.

I propose that it be some setting on default install if SPNEGO were
enabled to try it all times and then the 'whitelisted' IP spaces that
would then be used to determine the client IP check.

Something like:

Idp.spnego.featureEnabledIpSpace=<space_separated_ip_list_in_CIDR_format_an
d_useful_for_config_reuse>

With default being 'all IPs' ( 0.0.0.0/0 ::/0 )
E.g.
Idp.spnego.featureEnabledIpSpace='0.0.0.0/0','::/0'

This in turn could be used in the configuration in the same fashion as
access-control.xml uses it:
	<!--begin fragment-->
		<entry key="AccessSPNEGOByIPAddress">
		<bean parent="shibboleth.IPRangeAccessControl"
			p:allowedRanges="#{ {%{idp.spnego.featureEnabledIpSpace}} }" />
		</entry>
	<!-- end fragment -->


This way it can be left to the IdP operator on how to filter out the
SPNEGO experience based on how reachable their KDC is.


I'm not sure if the function of describing the access could be described
in access-control.xml or if it is visible at all to the SPNEGO mechanics
(maybe via a bean??).

I just know that it would be very handy to have a way to configure it
otherwise it's going to be frustrating to end users and reflect poorly on
the user experience as they roam.

Thoughts?

C



On 2015-12-02, 6:59 AM, "dev on behalf of Daniel Lutz"
<dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:

>>- the moment users attempt to use SPNEGO outside said network where the
>>KDC is unreachable, they must use password authentication
>
>Yes. Then, SPNEGO usually doesn't work. An activation condition should
>be setup that disables the SPNEGO login flow in this case.
>(The activation condition would check for the client's IP address.)