How to bypass defaultAuthenticationMethod

[Douglas E Engert]

On 2/2/2014 1:36 PM, Peter Schober wrote:
> * Vishvjit Khalipe <vishvjit at gmail.com> [2014-02-02 18:48]:
>> However, in some cases (where a user wants to login from another users
>> computer) we want to bypass the (defaultAuthenticationMethod) Kerberos
>> Login Handler and go directly to User Password page. Is there any out of
>> box config for this ?
>
> Shouldn't you be able to configure the Kerberos Login Handler in a way
> that it will not automatically attempt SPNEGO with Kerberos right
> away, but only on request of the subject?

Yes, and that is the default way the Kerberos login handler is installed.
Changes are made to the user/password jsp that add a Kerberos button.
The user can then choose between Kerberos or User/password.

> Granted that would change the behaviour (and require additional
> interaction) for all subjcts and all SPs, but would also allow for
> what you're asking?

We went down the path Vishvjit did, by setting defaultAuthenticationMethod
to Kerberos for one SP. But as he is finding out, the use of Kerberos is
more a decision of the user, and the browser then of the SP.


We backed off of that, and added a second URL for the SP, that would
set the_idp_krb_autologin cookie then redirect to the URL for the UnsolicitedSSO
for the SP in question.

This way the user/browser makes the choice of trying Kerberos first.

The way IE uses "Windows Integrated Authenticaion" complicated the matter.
Most other browsers would fail SPNEGO if not Kerberos tickets were available,
but IE would try and do the equivalent of a kinit or runas to get tickets
by using a popup to request a user/password form the user, then
contacting the KDC or AD DC even on computers that were not members
of the domain, such as from home.

> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> .
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>