Shibboleth and office 365 True SSO

[Aaron Howell]

> On 28 Jul 2015, at 9:09 PM, Tunturi Timo <timo.tunturi at aalto.fi> wrote:
>
> On 07/07/15 01:56, Aaron Howell wrote:
>> The main problem we had with completely auto login was being able to auto detect a supported workstation (one that would have a Kerberos ticket) - as being a university we have to support more students BYOD than staff machines
>
> The most accurate and consistent solution to this problem I have found is greylisting of networks, browser user-agents and usernames.
Laptops won’t work with that. I don’t find this a good approach for consistent user experience as the same machine will have different behaviour depending where it is located.
>
> SPNEGO is only offered if the network and user-agent are found acceptable. The result of the nego authentication is ignored (and a login form presented) if the username is found to not be acceptable (such as an admin account or any other type of user account configured to be unsuitable for SPNEGO on the IdP).
>
> In general it's not a good policy to have corporate/staff/similar devices in the same networks as BYOD, anyway. If you have a situation where it's all mixed up it's a lot more difficult to solve the problematic situation than to avoid it to begin with, though.
Also would not make sense for us, people still need to be allowed access to the same resources regardless of whether we provide the device or not. When you treat the entire user network as a potential threat - it is not actually so bad.
>
>> So there is also a Kerberos button on the User/Pass form - and an tick box to select Kerberos permanently - that will set a cookie. So when the user returns - kerberos is automatically attempted
>
> There are no perfect solutions for the problem. I don't find this a good approach for consistent user experience as end users have different policies on how long (or if at all) they want to retain cookies across browser sessions.
Too right there are no perfect solutions for all scenarios when the protocol is so narrow-sited - but we do what we can. The solution I proposed allowed a user to make a choice that they otherwise would not have the option for at all given our circumstances - so it has worked out well for those who choose to use it.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.