How to bypass defaultAuthenticationMethod

[Douglas E Engert]

On 2/2/2014 11:48 AM, Vishvjit Khalipe wrote:
> Hello,
>
> We are using Shibboleth IdP 2.3.6 + Kerberos Login Handler + user password login as fail-over to enable SSO for users.
>
> For all the relying parties we have Kerberos Login Handler as the Default Login Handler (defaultAuthenticationMethod). If kerberos authentication fails the user is redirected to user password login
> handler. So far, all the SP have requested unsolicited (IdP initialized) SSO.
>
> However, in some cases (where a user wants to login from another users computer) we want to bypass the (defaultAuthenticationMethod) Kerberos Login Handler and go directly to User Password page. Is
> there any out of box config for this ?

Sort of. Have the user run the browser as a different user. On Windows,
SHIFT+Right click on the IE icon. This will show a "Run as different User"
run as the user in question or a local account on the machine that does
not have a kerberos principal.

If no Kerberos tickets are available, IE's "Windows Integrated Authentication"
may then prompt for a user and password.


On Linux, set a different KRB5CCNAME environment variable to point at
a different or not existent Kerberos ticket cache before starting
the browser.



>
> Thank you in advance for your time and help.
>
> --
> Regards,
>    Vish
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>