apache2/idp kerberos RemoteUserInternal with Password flow fallback

[Tunturi Timo]

On 13/05/15 17:13, Cantor, Scott wrote:
> On 5/13/15, 9:54 AM, "Raffael Sahli" <sahli at gyselroth.com> wrote:
>
>> How can I configure the idp to allow both, RemoteUserInternal (apache2
>> krb5) and as fallback the Password Flow ?
>
> I don't think it's anything close to that simple with SPNEGO, but I have
> no experience with it. I just know it doesn't have fallback capabilities
> unless you do all the work and build extra UI to manage that. That's
> basically why it has to be done as a custom flow implemented in Java,
> which I know various people are working on prototypes of.

The fallback feature is in the browser. Browsers other than IE, anyway.

If your browser lands on a page that is a login form with a negotiate 
challenge header and it cannot* respond with a suitable negotiate 
response then it simply ignores the negotiate challenge and renders the 
login form as it would if the challenge header wasn't there.

In my experience only IE doesn't work this way but presents the user 
with a popup that looks like a basic auth popup.

* Isn't able to obtain a suitable ticket or is configured not to 
negotiate with the IdP.