SPNEGO, 3.2, ActivationCondition and SPNEGO-button on login.vm

[Cantor, Scott]

On 11/27/15, 10:26 AM, "users on behalf of Simon Lundström" <users-bounces at shibboleth.net on behalf of simlu at su.se> wrote:



>This is basically explained how to here[1] BUT since we also have the
>User-Agent conditions described first, Internet Explorer won't see the
>button since IE doesn't apply for the activation condition (and we don't
>want to include IE in it for obvious reasons).

You could modify the view template to skip the $extFlow.apply(profileRequestContext) check since you know what the condition is. I'm not sure in practice though how what you're talking about can work, since it seems non-deterministic. One time it shouldn't run and another it should.

>I thought about setting the _idp_krb_enabled cookies via JS when the
>button is pressed and then reload the site but that doesn't retrigger
>the authentication flow so it won't work.

Which button? There wouldn't be a SPNEGO button if it was checking the condition (that's what the default template does anyway). If the button were visible, you've already skipped the condition, and I don't believe it rechecks the condition if the event is signaled to run that method.

-- Scott