SPNEGO, 3.2, ActivationCondition and SPNEGO-button on login.vm

[Simon Lundström]

On Mon, 2015-11-30 at 13:28:39 +0100, Daniel Lutz wrote:
> On 11/27/15, 10:26 AM, "users on behalf of Simon Lundström" <users-bounces at shibboleth.net on behalf of simlu at su.se> wrote:
> >> We want to achieve:
> >> * Firefox and Safari should automatically try SPNEGO (since they degrade
> >>   gracefully) via ActivationCondition
> >> * On login.vm there should be a button which overrides and tries SPNEGO
> >>
> >> This is basically explained how to here[1] BUT since we also have the
> >> User-Agent conditions described first, Internet Explorer won't see the
> >> button since IE doesn't apply for the activation condition (and we don't
> >> want to include IE in it for obvious reasons).
> 
> Your use case is not supported currently. Unfortunately, we didn't
> consider this use case. We expected that all users need to opt-in
> by manually enabling the auto-login feature (even Firefox and Safari users),
> or that all clients are expected to support SPNEGO (and therefore trying
> SPNEGO can be enforced).
> 
> Cantor, Scott schrieb am 27.11.15 um 18:05:
> > You could modify the view template to skip the $extFlow.apply(profileRequestContext)
> > check since you know what the condition is.
> 
> Unfortunately, this seems not to work.
> At the time the view template (login.vm) is rendered, the SPNEGO login
> flow has been filtered out already according to the activation condition.

Yes and even if I set the cookie I can't just reload the page. I have to
"reset" the flow by going to the protected SP again and then it works as
expected. Can I from JS or a link "reinit" the auth flow?

> Cantor, Scott schrieb am 27.11.15 um 18:05:
> > I'm not sure in practice though how what
> > you're talking about can work, since it seems non-deterministic. One time it shouldn't
> > run and another it should.
> 
> To my understanding of this use case, it may be a reasonable use case.
> It basically means the following:
> - For Firefox and Safari, always directly run SPNEGO
>   (as if shibboleth.authn.SPNEGO.EnforceRun would be set to TRUE
>   for these browsers).
> - For IE, show the login page and let the users decide themselves
>   whether they want to try SPNEGO.

Your wording is much better than mine, this is exactly how we currently
have it and still want to have it.

> The current implementation doesn't allow to configure such a behavior.
> I need to think about a possible solution.

Much appreciated!

BR,
- Simon