Multiple Login Handlers

[Douglas E. Engert]

On 9/24/2013 11:35 AM, evilcraftknife wrote:
> Hello
>
> We have a Shibboleth IDP which has been working away in the background
> authenticating our college users for access to JISC resources. Our internal
> resources are currently protected by NTLM authentication because of the
> 'invisibility' of authentication. With more devices, browsers and Internet
> Explorer versions around I'm finding that this is becoming a bit of a pain
> to keep on top of which browsers are going to work properly with NTLM, so
> I'm thinking that the time has come to look at a better SSO solution. We've
> already got a working IDP so it seems an obvious choice. The problem is we'd
> like a 'silent' log in à la NTLM for computers connected to the local LAN.
> We have no issue using the username/password login page external to our
> network as NTLM prompts us for credentials anyway. I believe that the
> Kerberos login handler would be best internally.  Is there a simple way for
> the IDP to select an appropriate login handler based on IP addresses/CIDR?

The Kerberos-default.jsp does have some commented out code
  public static boolean isIpAllowed(HttpServletRequest request)...
looking at IP ranges so it might be possible.

It should also be possible to have the kerberos login handler try the GSS-API
first, and if it fails, then fall back to a normal login handler.

Not quite silent, but you could just add a Kerberos button to the login page.
Its one click for the users.

(We forced Kerberos based on RelyingParty for one application. Its a long story.)




>
> Kev
> Bolton Sixth Form College
> UK
>
>
>
>
> --
> View this message in context: http://shibboleth.1660669.n2.nabble.com/Multiple-Login-Handlers-tp7590213.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444