jaas authentication failover

[Liam Hoekenga]

>
> The real complexity is in the Principal object machinery, which is the
> other side of the map's value pair. That's not all that important if all
> the JAAS options amount to a single "kind" of authentication. If it were
> all just "password" login options that are equivalent to the outside world,
> then you can leave the Subject "slot" empty, and it's a bit simpler.
>

We're looking at using this to allow our IDP to authenticate both against
our KDC and our DB backed guest accounts.
Can I simplify the configuration if I have to support more than just
"password"?

Is it possible to return an error (that can bubble up to the UI) if the
user tries to authentication with combination that isn't supported?
The guest accounts aren't currently allowed to use MFA, and in the current
configuration, if someone tries a guest account, I see an error in my log...

2019-03-28 19:36:09,497 - xxx.xxx.xxx.xxx - DEBUG
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:318] -
Profile Action ValidateUsernamePasswordAgainstJAAS: Skipping JAAS config
'GuestPasswordAuth', not compatible with request's principal requirements

but the user just sees a fresh login screen again w/ no feedback.

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190328/bbe4ca79/attachment.html>