Shibboleth and office 365 True SSO

[Tunturi Timo]

On 07/07/15 01:56, Aaron Howell wrote:
> The main problem we had with completely auto login was being able to auto detect a supported workstation (one that would have a Kerberos ticket) - as being a university we have to support more students BYOD than staff machines

The most accurate and consistent solution to this problem I have found 
is greylisting of networks, browser user-agents and usernames.

SPNEGO is only offered if the network and user-agent are found 
acceptable. The result of the nego authentication is ignored (and a 
login form presented) if the username is found to not be acceptable 
(such as an admin account or any other type of user account configured 
to be unsuitable for SPNEGO on the IdP).

In general it's not a good policy to have corporate/staff/similar 
devices in the same networks as BYOD, anyway. If you have a situation 
where it's all mixed up it's a lot more difficult to solve the 
problematic situation than to avoid it to begin with, though.

> So there is also a Kerberos button on the User/Pass form - and an tick box to select Kerberos permanently - that will set a cookie. So when the user returns - kerberos is automatically attempted

There are no perfect solutions for the problem. I don't find this a good 
approach for consistent user experience as end users have different 
policies on how long (or if at all) they want to retain cookies across 
browser sessions.