Kerberos SSO with fail over to login auth

[Aaron Roots]

Thanks for the response Nick.

One of the business requirements for our Single Sign On project: The
successful authentication of logging into the SOE OS needs to mean that
you are automatically authenticated to protected web pages and are not
prompted to authenticate again.

So unless I can make the Shibboleth IdP the login screen for Windows I
need to use another method
- Kerberos is available and is possible:
https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler
- but I also need to rework the out of the box solution to truly achieve
what we need as our business requirements.


Cheers
Aaron



On 27/10/11 3:27 PM, "Nick Duan" <nduan at verizon.net> wrote:

>Shouldn't Shibboleth be the "Internet replacement" of Kerberos?  Why do
>you
>want to make these two play together? Each serves different purpose in
>different environment.  What would be the use case for integrating
>Kerberos
>with Shibboleth?
>
>Thanks!
>
>ND
>
>
>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>On
>Behalf Of Aaron Roots
>Sent: Wednesday, October 26, 2011 6:17 PM
>To: Shib Users
>Subject: Kerberos SSO with fail over to login auth
>
>Hi all,
>
>Just looking if anyone has successfully setup Kerberos Auth to the
>Shibboleth IdP that occurs automatically - but if there is no ticket or
>the ticket is not valid then it fails back to the login web page.
>
>I am just about to start looking into achieving this - from the
>preliminary reading I have done so far I have seen the following:
>* Fully Kerberos with no fail over as all users are using an SOE
>* Choice of login type on the login web page
>* Using Apache - but fails over to a basic auth box instead of a login
>screen
>* Wanting the above scenario - but not having achieved it yet
>
>I am hoping somebody may have had some success that I haven't come across
>yet and have any advice they could share. If not that's all good - just
>means I'll probably be very busy for a few weeks :)
>
>Cheers heaps,
>Aaron
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net