AW: Kerberos SSO with fail over to login auth

[Ristow Rodrigo]

Hy Aaron,

>> would it be possible to fail without issuing the 401 and somehow let Shibboleth try another login handler...
If the server doesn't response with the "401-authentication" error, the browser will assume that no authentication is needed (or already done) and the kerberos-negotiation will not occur.

>> Or am I missing something client browser side that will cause this to break?
These are the configurations related to kerberos:  https://wiki.shibboleth.net/confluence/display/SHIB2/Single+sign-on+Browser+configuration 
I don't know a way to configure a "failback -action", unless you implement some kind of plug-in for the browser.

You can personalize the "customUnauthorized" error page with something like: "It was not possible to login with kerberos, please click here to go to the login page". Unfortunately it'll not work properly with IE (because the NTLM failback).

>> Or the way Login Handlers work?
I'd say, the way SPNEGO works (see also https://wiki.jasig.org/display/CASUM/SPNEGO). 

Rodrigo


-----Ursprüngliche Nachricht-----
Von: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] Im Auftrag von Aaron Roots
Gesendet: Freitag, 28. Oktober 2011 06:34
An: Shib Users
Betreff: Re: Kerberos SSO with fail over to login auth

Thank you to all that responded - there some really good information that will help greatly. 

The javascript for auto submitting browsers that have been configured as compatible - appears to be an attractive work around

I may be on the wrong track here - but as I understand the RFC4559 is a description of SPNEGO using Kerberos with failover to NTLM written by Microsoft for their Integrated Windows Auth designed for Windows 2000 IIS.

A decade later, behaviour that might be better from a Shibboleth point of view would be Kerberos with failover to Shibboleth  web login. From looking at the source code, we seem to be issuing the 401 - would it be possible to fail without issuing the 401 and somehow let Shibboleth try another login handler? Or am I missing something client browser side that will cause this to break? Or the way Login Handlers work?

Either way - I think I still have a bit of reading to do.

Cheers
Aaron

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net