Manual selection of authentication method

[Cantor, Scott]

On 11/24/16, 9:48 AM, "users on behalf of Marco Naimoli" <users-bounces at shibboleth.net on behalf of marco.naimoli at unipd.it> wrote:

>    Hi, my IDP (3.2.1) installation uses Password authentication; I've added
>    a RemoteUser authentication (and it works), but the final user cannot
>    choose what authentication method to use, IDP chooses, based on
>    general-auth.xml file.

Well, it chooses based on the requirements of the SP via request or configuration. Those requirements are evaluated against what the flow descriptors say they can support.

>    I'd like to have a simple login page with user/password and a "link" (or
>    something similar) for the RemoteUser auth; and, in general, I'd like
>    to know if it's possible to create a page where a user can choose among
>    all authentication methods supported.

Yes, with work. The older version supports a mechanism for the Password flow to invoke other flows, which was documented as "extended flows". It's a bit ugly and complicated, but it can do something like this.

You should upgrade to 3.3 and use the MFA flow. It's not about MFA, it's really about scripting workflows. But building a view to give users a selection mechanism is not done for you, you will have to learn Spring Web Flow and how to do basic views to do such a thing.

-- Scott