Kerberos SSO with fail over to login auth

[caleb racey]

We have Kerberos autologin setup on our IdP via the SPNEGO handler that Rodrigo and his team developed (it is excellent work), it is handling in the region of 17000 logins a day without any problems. 

As Rodrigo alludes to the error behaviour of browsers that do not have a valid Kerberos ticket is  a major issue. The behaviour depends on the browser being used and it's configuration and network setup.....the worst case scenario we have seen is  a basic auth grey pop up login box appears while the browser is still showing the url of the SP or WAYF, the end user therefore has no means of seeing if they are entering their password into a legitimate IdP.   We view this as potentially training our user population to put their password into any grey login box that pops up and ask for it (very few would understand the difference between a wayf or SP url and any other url). Also our view is that the different behaviour of browsers would result in an unacceptable support workload should we try and support auto login for them. 

To work round this we only  trigger spnego login when we are sure it will work, so we detect if a user is on campus from their ip address,  and has a browser user agent set to a predefined string by our Acitive Directory (AD) policy based build. This means they are using a machine that is managed by our active directory and therefore will be logged into the AD and have a kerb ticket.  We then also prevent spnego from users coming in via our vpn service or one of our wireless networks (magpie).  We also only allow autologin to a subset of our own SPs

Snippet of javascript from our IdP that does this below    


function spnego(sp, ip)
{
  // IPs we don't want to autologin 
  if (ip.indexOf("10.12.", 0) == 0) { return; } //(magpie  wireless)
  else if (ip.indexOf("10.13.", 0) == 0) { return; } //(magpie wireless)
  else if (ip.indexOf("10.6.", 0) == 0) { return; } //(ivpn vpn)
  else if (ip.indexOf("128.240.246.", 0) == 0) { return; } //(evpn vpn)

  var autoSPs=[ "https://internal.ncl.ac.uk/shibboleth/metadata",
                "https://directory.ncl.ac.uk/shibboleth/metadata",
                "https://my.ncl.ac.uk/shibboleth/metadata",
                "https://unixmon.ncl.ac.uk/shibboleth/metadata",
                "https://apps.ncl.ac.uk/shibboleth/metadata"];
  var autoIPs=[""];

  if (autoSPs.join().indexOf(sp)>=0)
  {
    if (autoIPs.join().indexOf(ip)>=0)
    {
      window.location = "/idp/Authn/Kerberos/Login"; //send user to spnego based login
    }
    // autologin host, check ip/browser compatibility
    if ((ip.indexOf("10.",0) == 0 || ip.indexOf("128.240.",0) == 0) && (navigator.userAgent.indexOf("campus-ncl") != -1))
    {
      window.location = "/idp/Authn/Kerberos/Login";  //send user to spnego based login 
    }  
  }
  else
  {
    return;  //send user back to form based login 
  }
}

Power users on firefox, google chrome, safari etc can get spnego based autologin by hand altering their browsers  user agent and making sure they have a Kerberos ticket. 

Other pain points are people who use role base accounts, they  get auto logged into sites as their personal id and can't use their role account....the work around for us is to get them to use a different browser for role account login (not a very elegant solution admittedly). 

So yes you can get spnego autologin to work with shib and be a useful service but there are many  caveats and it is not a silver bullet as far as true single sign on goes.   


Cal

Caleb Racey
Systems Architecture Manager
Newcastle University 




>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>On Behalf Of Ristow Rodrigo
>Sent: 27 October 2011 9:47 AM
>To: Shib Users
>Subject: AW: Kerberos SSO with fail over to login auth
>
>Hi Aaron,
>
>We have this scenario implemented in our organization (Shibboleth
>authentication trough the Kerberos/Active Directory credentials).
>To understand exactly what happens when the ticket-request negotiation
>fails (no kerberos tickets, browser misconfigured, etc.), you need to
>take a look in the SPNEGO documentation:
>http://www.ietf.org/rfc/rfc4559.txt
>
>This is the pitfall using Kerberos, because each browser can take
>different steps after receiving the "401 Unauthorized" response (part of
>the negotiation). For example:
>  - Internet explorer will automatically "downgrade" to NTLM and ask for
>username/password in a popup;
>  - Firefox will show the "401 error page" (which can be customized,
>take a look at "customUnauthorized" in the kerberos-Idp documentation)
>
>In our case, we just avoid this situation. We verify first if the user
>has the kerberos-ticket with some heuristic (you can use maybe the ip-
>range) and then we show or hide the kerberos-authentication part in the
>login screen.
>
>Please let me know if you have any other solution or idea for this
>problem, this is also interesting for other people.
>
>Rodrigo
>
>
>----Ursprüngliche Nachricht-----
>Von: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>Im Auftrag von Aaron Roots
>Gesendet: Donnerstag, 27. Oktober 2011 06:48
>An: Shib Users
>Betreff: Re: Kerberos SSO with fail over to login auth
>
>Thanks for the response Nick.
>
>One of the business requirements for our Single Sign On project: The
>successful authentication of logging into the SOE OS needs to mean that
>you are automatically authenticated to protected web pages and are not
>prompted to authenticate again.
>
>So unless I can make the Shibboleth IdP the login screen for Windows I
>need to use another method
>- Kerberos is available and is possible:
>https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Hand
>ler
>- but I also need to rework the out of the box solution to truly achieve
>what we need as our business requirements.
>
>
>Cheers
>Aaron
>
>
>
>On 27/10/11 3:27 PM, "Nick Duan" <nduan at verizon.net> wrote:
>
>>Shouldn't Shibboleth be the "Internet replacement" of Kerberos?  Why do
>>you want to make these two play together? Each serves different purpose
>>in different environment.  What would be the use case for integrating
>>Kerberos with Shibboleth?
>>
>>Thanks!
>>
>>ND
>>
>>
>>-----Original Message-----
>>From: users-bounces at shibboleth.net
>>[mailto:users-bounces at shibboleth.net]
>>On
>>Behalf Of Aaron Roots
>>Sent: Wednesday, October 26, 2011 6:17 PM
>>To: Shib Users
>>Subject: Kerberos SSO with fail over to login auth
>>
>>Hi all,
>>
>>Just looking if anyone has successfully setup Kerberos Auth to the
>>Shibboleth IdP that occurs automatically - but if there is no ticket or
>>the ticket is not valid then it fails back to the login web page.
>>
>>I am just about to start looking into achieving this - from the
>>preliminary reading I have done so far I have seen the following:
>>* Fully Kerberos with no fail over as all users are using an SOE
>>* Choice of login type on the login web page
>>* Using Apache - but fails over to a basic auth box instead of a login
>>screen
>>* Wanting the above scenario - but not having achieved it yet
>>
>>I am hoping somebody may have had some success that I haven't come
>>across yet and have any advice they could share. If not that's all good
>>- just means I'll probably be very busy for a few weeks :)
>>
>>Cheers heaps,
>>Aaron
>>
>>--
>>To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>>
>>--
>>To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to users-
>unsubscribe at shibboleth.net
>--
>To unsubscribe from this list send an email to users-
>unsubscribe at shibboleth.net