[Ext] RE: Flag to identify if user selected SSO or not

[Nate Klingenstein]

>> I’ll just observe that we used to have discovery that remembered your selection.  Now, we don’t have it anymore.
> 
> Not sure what is meant by that, but both the (soon to be defunct) CDS and the (very much alive) EDS have always remembered the selection.

“Always remember my selection" was bad, but I can hear myself in the following conversations already, especially the first.

1)  “My login session at the IdP expired but I’m still logged into the application.  There is no logout link.  WTF?"
2)  “I selected SSO and now I can’t log out of application XYZ.  Now my friend can’t use it and it’s a security risk."
3)  “Application ABC works this way.  Why does application DEF work that way?”

> They just don't (by default, absent isPassive) follow the selection without user interaction.

I still think it depends on the interface.

Consider discovery with login.microsoftonline.com versus www.sciencedirect.com versus wiki.shibboleth.net versus Google Apps versus moodle.smith.edu versus DiscoJuice versus — all of these are different.

I have no consistent story to tell users.  What will they get prompted for?  When will it happen?  How do they avoid getting phished?

We’re not pushing for more SSO here.  We’re pushing for more MFA, and hard.

> See however https://issues.shibboleth.net/jira/projects/EDS/issues/EDS-73 which will be in EDS 1.2.  There are some _very constrained_ environments when this can be useful.

Yes, hence the short question being “is this better than the alternative?”