Multi-Context Broker functionality in Shibboleth v3 - Comments please.

[Cantor, Scott]

On 4/20/15, 2:21 PM, "IAM David Bantz" <dabantz at alaska.edu> wrote:

>We recently encountered users failing authN 3 times in succession being returned to the SP and there receiving no useful information.  Arguably the SP should be smarter and provide a more helpful response to users,
> but in fact they merely received a generic error message, triggering support calls.  I reset the max number of failures to 99 to  In the current functionality draft this ability (#7 gap) is said to be "determined
> that this MCB feature is not needed."  What do you anticipate the user experience to be in that eventuality?

Most people running IdPs don't provide a way around a password prompt, because there's no place to go. Sending them to the SP isn't likely to help much, so there seems little point to doing that to me at whatever count. If you want to provide a bailout button, that seems like a more rational approach than arbitrary limits.

-- Scott