Architecture of SPNEGO/Kerberos login flow

[cneberg]

>Depending on the result of the script, the SPNEGO login flow will run or
not.

Nice solution.    This is the type of solution I was referring to when I
said it would be nice to make it general ie if all auth scripts could
easily use a similar activation condition.   For examples force more 2
factor type auth plugins for users outside of a specific IP range.

Thank you Daniel and Scott for your feedback.  Your solution(s) will help
me remove some of my less general custom code going forward.

-Topher

On Mon, Sep 28, 2015 at 9:08 AM, Daniel Lutz <daniel.lutz at switch.ch> wrote:

> cneberg schrieb am 26.09.15 um 22:36:
> > The solution I use to this problem is pretty simple modify the 401 error
> > response to redirect or just be the failover auth mechanism.   If the
> > browser can't do spnego it'll render the error page.
>
> Thank you for your comments.
>
> The SPNEGO login flow for IdP V3 will support such an error page.
> The page will be customizable by a velocity template.
>
> Besides showing an error message, JavaScript code in the page can
> redirect back to the IdP, in case the browser doesn't support SPNEGO
> (and shows the error page instead). This way, the user won't see the
> error page at all. The redirection back to the IdP will notify the
> login flow about an error, so the IdP can cancel SPNEGO and show
> the user a meaningful error message.
>
> > Issues
> > 1) there is at least one off mobile browsers which can't do this so you
> > still need exclusions based on useragent  (thursby browser)
> > 2) IE must have the DNS range in its intranet sites list and auto login
> > in intranet zone or users will be prompted anyway and if they can't
> > reach a DC the prompt will fail. So you need to push some configuration
> > to your clients and still have ip restrictions for those off site.
> > 3) IE logged into a different AD domain unrelated to the shib will
> > prompt in a way that can't succeed. (Ip restrictions needed)
>
> The SPNEGO login flow will allow a deployer to specify conditions
> using JavaScript. This is implemented by attaching a script based
> activation condition to the login flow. Depending on the result
> of the script, the SPNEGO login flow will run or not.
>
> The script will be able to access information like the client's IP
> address, user agent identifier, cookie values, etc.
>
> This script based activation condition should allow to address the
> issues described above.
>
> > 4) you need to include conversation key in the error redirect or all is
> > lost which is sometimes difficult if you try to do this in the webserver
> > or app server assumes a static error page URL.
>
> Yes. The error page the SPNEGO login flow sends to the browser will
> contain the conversation key in the link back to the IdP, so this
> will work.
>
>
> -- Daniel
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150930/0c1de08e/attachment.html>