Basic Authentication on Password flow

[Marco Naimoli]

Thank you Vincent, it's a very good idea

Marco

Il 14/12/2016 15:04, Feyaerts Vincent ha scritto:
>
> Are you planning to place your IdP behind a load balancer acting as a
> reverse proxy? Then you could just remove the Basic Authentication
> headers there. In our case we have our IdP load balanced behind an F5
> Big-IP anyway for failover so it’s easy to remove these headers. Maybe
> you have a similar set-up.
>
>  
>
> Kind regards
>
> Vincent Feyaerts
>
>  
>
> *From:*users [mailto:users-bounces at shibboleth.net] *On Behalf Of
> *Marco Naimoli
> *Sent:* woensdag 14 december 2016 14:57
> *To:* users at shibboleth.net
> *Subject:* Re: Basic Authentication on Password flow
>
>  
>
> Il 14/12/2016 14:18, users-request at shibboleth.net
> <mailto:users-request at shibboleth.net> ha scritto:
>
>     On 12/14/16, 4:29 AM, "users on behalf of Marco Naimoli" <users-bounces at shibboleth.net on behalf of marco.naimoli at unipd.it>
>     <mailto:users-bounces at shibboleth.netonbehalfofmarco.naimoli@unipd.it> wrote:
>
>      
>
>         > What is the correct and simpler way to disable this feature (hope it's not creating a new flow) ?
>
>     There is no supported way. You can file a RFE for that, it would just take a fairly simple patch and you would be able to apply that ahead of time in a manner that would survive upgrades in the future since it would match the change made to the code.
>
>      
>
>     I'd be curious why you care about this though.
>
>      
>
>     -- Scott
>
> I'd like to control to switch on or off this feature; I have this need
> because we have a test IDP installation, protected by a basic auth:
> users that wants
>
> to use it must authenticate with a personal password. Then they can do
> their tests using test users with test passwords; in a standard IDP
> installation
>
> users receive an error about a failed authentication, due to the check
> of the basic auth data. It's an aesthetic problem, I could solve it
> modifying views,
>
> probably, but I don't want also that anyone can authenticate "outside"
> the IDP, to avoid that a site/webapp can be used to collect user passwords
>
> In the future I could choose to enable this feature, for some directly
> controlled SP: that's why I was looking a simple way (like changing a
> parameter)
>
> to switch the feature on or off
>
> Thank you very much
>
> Marco
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161214/e828158f/attachment.html>