SPNEGO, 3.2, ActivationCondition and SPNEGO-button on login.vm

[Daniel Lutz]

On 11/27/15, 10:26 AM, "users on behalf of Simon Lundström" <users-bounces at shibboleth.net on behalf of simlu at su.se> wrote:
>> We want to achieve:
>> * Firefox and Safari should automatically try SPNEGO (since they degrade
>>   gracefully) via ActivationCondition
>> * On login.vm there should be a button which overrides and tries SPNEGO
>>
>> This is basically explained how to here[1] BUT since we also have the
>> User-Agent conditions described first, Internet Explorer won't see the
>> button since IE doesn't apply for the activation condition (and we don't
>> want to include IE in it for obvious reasons).

Your use case is not supported currently. Unfortunately, we didn't
consider this use case. We expected that all users need to opt-in
by manually enabling the auto-login feature (even Firefox and Safari users),
or that all clients are expected to support SPNEGO (and therefore trying
SPNEGO can be enforced).

Cantor, Scott schrieb am 27.11.15 um 18:05:
> You could modify the view template to skip the $extFlow.apply(profileRequestContext)
> check since you know what the condition is.

Unfortunately, this seems not to work.
At the time the view template (login.vm) is rendered, the SPNEGO login
flow has been filtered out already according to the activation condition.

Cantor, Scott schrieb am 27.11.15 um 18:05:
> I'm not sure in practice though how what
> you're talking about can work, since it seems non-deterministic. One time it shouldn't
> run and another it should.

To my understanding of this use case, it may be a reasonable use case.
It basically means the following:
- For Firefox and Safari, always directly run SPNEGO
  (as if shibboleth.authn.SPNEGO.EnforceRun would be set to TRUE
  for these browsers).
- For IE, show the login page and let the users decide themselves
  whether they want to try SPNEGO.

The current implementation doesn't allow to configure such a behavior.
I need to think about a possible solution.

-- Daniel