Architecture of SPNEGO/Kerberos login flow

[Cantor, Scott]

On 9/26/15, 4:36 PM, "dev on behalf of cneberg" <dev-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:
>I implemented crude rules engine which would let me select auth types by level of assurance of each of the auth types,  ip, useragent, SP, cookie contents (for user customized configs) and requested auth type which simplified the selection process greatly and at the end just shows a menu of what's left.

If I could get people generally to accept the idea of a list up front, particularly in light of needing to prompt for the username *first* before you can present that list, I'd be a lot happier, but so far that's not been an appealing UI to people.

I designed things originally so that such a list (and rules engine if you really want to make it that hard) could be implemented as a pseudo-login flow that doesn't actually produce a result, but just uses the signaling capability to invoke the other login flows. But I'm warming to the idea of building this as a an actual replacement for the built-in select flow action because of the error handling problems, the need to recover from a failed choice.

This particular work is just about trying to make it possible to present the password option at the *same time* as the other options without doing a lot of damage to the password flow. So far the changes are minimal, but if somebody wanted to embed an entire layer of their own code to determine what methods to offer, that would drop in very easily as a custom view object.

That same code would be most of the work involved in building a selector that doesn't include the password code, so it's all one and the same really.

>So because of the amount of work required to do it right I recommend putting selection criteria in a higher level meta auth type selector rather than in a specific auth type itself so every auth selection process can benefit.

Since I didn't build anything like that, the thing I didn't build isn't limited to a specific login flow.

-- Scott