Kerberos Authentication

[Douglas E Engert]

On 3/31/2015 4:03 AM, Jarno Huuskonen wrote:
> Hi,
>
> On Tue, Mar 31, Dave Perry wrote:
>> Thanks Caleb.
>> I did broach the idea of a modified user agent with our desktop team and they basically panicked that it would break stuff - I'm thinking more realistic an idea would be if I could get spengoscript to activate if something is in the url (e.g. &autologin=1, or a hidden variable posted from a button).
>>
>> I'll come back to this when we hear more news from your end. And my new IdP sort of behaves normally..
>
> When we tested (with idp-2.4.x) spnego authentication we activated
> spnego if:
> - client ip was in our network (+ vpn networks)
> - client browser sent uefspnego cookie (we created a powershell script
>    that would set the cookie(cookie lifetime was set to years) in IE (idea
>    was to run this powershell on desktop login scripts)).

With the older IDP Kerberos contribution from SWITCH, the switch code would look for the
_idp_krb_autologin=true cookie. Our IDP login script would look for the cookie first
and try the SPNEGO. If it failed it would fall back to the normal login.

We added a few cgi-bin scripts to the IDP, to turn this on, to turn it off
and for selected SP to turn it on for some time period then redirect the user to the IDP for Unsolicited SSO
then to the selected SP.

In effect the URL the user was given could force SPNEGO to be tried before the normal login page
was shown.

>
> (this uefspnego cookie was also because changing IE user-agent could
> break something ...).
>
> -Jarno
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>