Basic Authentication on Password flow

[Feyaerts Vincent]

Are you planning to place your IdP behind a load balancer acting as a reverse proxy? Then you could just remove the Basic Authentication headers there. In our case we have our IdP load balanced behind an F5 Big-IP anyway for failover so it’s easy to remove these headers. Maybe you have a similar set-up.

Kind regards
Vincent Feyaerts

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Marco Naimoli
Sent: woensdag 14 december 2016 14:57
To: users at shibboleth.net
Subject: Re: Basic Authentication on Password flow

Il 14/12/2016 14:18, users-request at shibboleth.net<mailto:users-request at shibboleth.net> ha scritto:

On 12/14/16, 4:29 AM, "users on behalf of Marco Naimoli" <users-bounces at shibboleth.net on behalf of marco.naimoli at unipd.it><mailto:users-bounces at shibboleth.netonbehalfofmarco.naimoli@unipd.it> wrote:



> What is the correct and simpler way to disable this feature (hope it's not creating a new flow) ?

There is no supported way. You can file a RFE for that, it would just take a fairly simple patch and you would be able to apply that ahead of time in a manner that would survive upgrades in the future since it would match the change made to the code.



I'd be curious why you care about this though.



-- Scott

I'd like to control to switch on or off this feature; I have this need because we have a test IDP installation, protected by a basic auth: users that wants

to use it must authenticate with a personal password. Then they can do their tests using test users with test passwords; in a standard IDP installation

users receive an error about a failed authentication, due to the check of the basic auth data. It's an aesthetic problem, I could solve it modifying views,

probably, but I don't want also that anyone can authenticate "outside" the IDP, to avoid that a site/webapp can be used to collect user passwords

In the future I could choose to enable this feature, for some directly controlled SP: that's why I was looking a simple way (like changing a parameter)

to switch the feature on or off

Thank you very much

Marco
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161214/f5ae93cf/attachment-0001.html>