Architecture of SPNEGO/Kerberos login flow

[Daniel Lutz]

> Here the solution we chose for CAS is to tell people to use Firefox.
> For IE browsers, we do not propose spnego.
> (except for configured IE which have "Kerberos" in user-agent, ie those
> we know are in AD)

Thank you for this comment.

That's definitively an option an organization can choose.

Actually, we already implemented a mechanism that allows a deployer
to specify certain conditions to enable the SPNEGO/Kerberos login flow.
(I didn't mention this in my initial post.)

Currently, supported conditions are:
- The client is part of a certain IP range
- The user-agent identifier contains some string, e.g "Kerberos"

So it's possible to disable SPNEGO/Kerberos if the browser is IE
and doesn't contain "Kerberos" in the user-agent identifier.

An independent "standalone" SPNEGO/Kerberos flow, that can be run
before the Password flow, is implemented, too. So, organizations
that want to force SPNEGO/Kerberos login, if it's available, can
do this.

Given this, my initial statement

> The only way to reliably avoid this problem seems to
> be to force the user to opt-in for SPNEGO/Kerberos login.

may not be fully true.

Still, there may be organizations that don't wan't to force
SPNEGO/Kerberos login for all users. They may want to
let the users choose. This is a use case where a combined
login page would be useful.


- Daniel