User authentication with 2 methods

[Kevin P. Foote]

On Thu, 14 Nov 2013, Björn Urbanek wrote:

> 1.) try to authenticate with the currently to computer logged in user (via
> NTLM (?))
> 2.) If it fails, then use Username/Password login handler, the users have to
> enter username/pwd
>
> What do you think is the best practice for this?

Note, I have not done this.. But, the basics are you are combining a
Kerberos LoginHandler with the UsernamePassword LoginHandler.

Below is the best found resource for such a config within the shibboleth
ecosystem.

<http://research.ncl.ac.uk/gfivo/documents/UsingKerberosticketsfortrueSingleSignOn.pdf>

------
thanks
  kevin.foote