Architecture of SPNEGO/Kerberos login flow

[Pascal Rigaux]

On 16/09/2015 19:50, Daniel Lutz wrote:
> But there's at least one problem with this approach: If
> Internet Explorer is used, and Kerberos is not supported
> by the client, Internet Explorer would fall back to NTLM
> and show a login box to the user.

Hi,

Here the solution we chose for CAS is to tell people to use Firefox.
For IE browsers, we do not propose spnego.
(except for configured IE which have "Kerberos" in user-agent, ie those we know are in AD)

cu,
Pascal Rigaux.


-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.