Kerberos SSO with fail over to login auth

[James Bardin]

On Thu, Oct 27, 2011 at 12:48 AM, Aaron Roots <aaron.roots at deakin.edu.au> wrote:
> One of the business requirements for our Single Sign On project: The
> successful authentication of logging into the SOE OS needs to mean that
> you are automatically authenticated to protected web pages and are not
> prompted to authenticate again.


I was recently given a similar spec, which was later rejected due to
the concerns people listed previously. Authentication fallback
behavior varies between browsers, and IIRC, one combination of
OS/browser caused the user to be prompted twice for their username and
password.

If you can limit your user-base to domain-joined, windows clients, and
IE only, then you will probably be OK, but any heterogeneity will
cause headaches.

As for the actual authentication step, you could use the
RemoteUserAuthHandler behind an custom page that handles the
authentication any way you wish.

-jim