Silently try more then one login handler with UnsolicitedSSO

[Henry B. Hotz]

On Apr 29, 2013, at 6:37 PM, Douglas E. Engert <deengert at anl.gov> wrote:

> No, the https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler
> does its own SPNEGO.
> 
> The https://wiki.shibboleth.net/confluence/display/SHIB2/X.509+Login+Handler
> gets the client certificate used with the Apache SSL.

[. . .]

> The above two handlers jsp pages can be merged with the login.jsp
> used for PasswordProtectedTransport.
> 
> This gives the user the choice of which one to use. (If it fails, the user
> may have to start over. The Kerberos login handler also sets some cookies
> for auto_login to just try it first. Its the error handling if this fails
> that I am having problems with.

I think I'll still finish off my experiment with mod_jk, etc.  Let me know how it goes though.  We're obviously trying to satisfy the same requirements, and I think your approach may be a lot more user-friendly.

I don't think my approach gives me enough control to provide the right user experience.  OTOH, I'm not sure what the right user experience *should* be in the face of multiple, valid authentication methods.  The Kerberos-based expectation would be that the user never sees the IdP at all, but that prevents the user from using, e.g. a smart card.

Maybe I'm overthinking it?  NIST 800-63 says SAML is only LoA 3, even if it required an LoA 4 smart card initially.

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu