allowing currently authenticated users access, but sending non-authenticated users to a DS?

[Cantor, Scott]

On 8/12/14, 1:16 PM, "Liam Hoekenga" <liamr at umich.edu> wrote:
>
>She wants users who are authenticated using local credentials via
>shibboleth to be allowed access,  but for unauthenticated users to be
>sent through some discovery mechanism.  ("If they're authenticated with
>the local credential, don't even offer them the ability to log in using
>something else")

If you mean "has logged into the IdP already", that's basically what
IsPassive combined with a fair amount of application intelligence is
designed to do.

>The SP has to send an authn request /somewhere/.  If we do use the SP's
>default IdP, it only /looks/ transparent to the user.  The SP and the IdP
>still have to talk.  The SP isn't going to know if the user has
>authenticated to the IdP until it tries it.

No, but IsPassive tells it not to do anything but return an error if the
user isn't.

>If the SP wasn't set to use the default IdP, the user would get sent to
>the DS and have to choose U-M.

That assumes active session checking. Most of this kind of thing involves
passive checking and use of application layer code to decide what to do
and when to do it.

>So.. it seems like it would be something along the lines of... send the
>user to the default IdP.  If they're authenticated there, handle the
>authn request, and send them back.   If they aren't authenticated there,
>send them to a DS.
>
>Is that even possible?

Yes, with some work. With no coooperation on the application side, it's
fairly difficult.

-- Scott