Architecture of SPNEGO/Kerberos login flow

[Daniel Lutz]

cneberg schrieb am 26.09.15 um 22:36:
> The solution I use to this problem is pretty simple modify the 401 error
> response to redirect or just be the failover auth mechanism.   If the
> browser can't do spnego it'll render the error page.

Thank you for your comments.

The SPNEGO login flow for IdP V3 will support such an error page.
The page will be customizable by a velocity template.

Besides showing an error message, JavaScript code in the page can
redirect back to the IdP, in case the browser doesn't support SPNEGO
(and shows the error page instead). This way, the user won't see the
error page at all. The redirection back to the IdP will notify the
login flow about an error, so the IdP can cancel SPNEGO and show
the user a meaningful error message.

> Issues
> 1) there is at least one off mobile browsers which can't do this so you
> still need exclusions based on useragent  (thursby browser)
> 2) IE must have the DNS range in its intranet sites list and auto login
> in intranet zone or users will be prompted anyway and if they can't
> reach a DC the prompt will fail. So you need to push some configuration
> to your clients and still have ip restrictions for those off site.
> 3) IE logged into a different AD domain unrelated to the shib will
> prompt in a way that can't succeed. (Ip restrictions needed)

The SPNEGO login flow will allow a deployer to specify conditions
using JavaScript. This is implemented by attaching a script based
activation condition to the login flow. Depending on the result
of the script, the SPNEGO login flow will run or not.

The script will be able to access information like the client's IP
address, user agent identifier, cookie values, etc.

This script based activation condition should allow to address the
issues described above.

> 4) you need to include conversation key in the error redirect or all is
> lost which is sometimes difficult if you try to do this in the webserver
> or app server assumes a static error page URL.

Yes. The error page the SPNEGO login flow sends to the browser will
contain the conversation key in the link back to the IdP, so this
will work.


-- Daniel