SPNEGO Activation condition breaks session manager properties

[Daniel Lutz]

Robert Duncan [26.01.18 13:07]:
> I have SPNEGO login flow active and working well, however I do need to restrict its' availability and am trying the activation condition based on the examples:
> https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration#SPNEGOAuthnConfiguration-ExampleConditionsinJavaScript:

> This should disable SPNEGO on my VLAN for testing, but the idp complains:

I think the problem is that you need to place your activation condition bean outside the
<util:list id="shibboleth.AvailableAuthenticationFlows">, e.g. just before it:

    ...

    <bean id="shibboleth.SPNEGO.ActivationCondition" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript"
             p:customObject-ref="shibboleth.HttpServletRequest">
         <constructor-arg>
            <value>
              <![CDATA[
                    var activate = false;
                    if (custom.remoteAddr.startsWith("192.168.42.")) {
                    activate = true;
                    }
                    activate;
                 ]]>
            </value>
        </constructor-arg>
   </bean>

    <util:list id="shibboleth.AvailableAuthenticationFlows">

    ...

I've just updated the documentation to make this clearer.


- Daniel