jaas authentication failover

[Cantor, Scott]

On 3/28/19, 7:38 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> The guest accounts aren't currently allowed to use MFA, and in the current configuration, if someone tries a guest
> account, I see an error in my log...

It's better to deal with MFA logic well outside JAAS or the Password flow. The MFA layer is where that kind of work belongs. If you're talking Duo, that's something the MFA scripting can handle invoking selectively, it shouldn't impact anything near the JAAS bits.
 
> but the user just sees a fresh login screen again w/ no feedback.

If it can't run *any* JAAS configurations at all because of e.g. SAML AuthnContext signaling, it signals back "RequestUnsupported" as the event, and there's a warning in the log about it. If it tries at least one of them, then it would log something else and probably signal "InvalidCredentials", but that would probably cause feedback to appear.

"RequestUnsupported" is not something the default error handling examples include. It's not one of the classified error events it knows about. It really isn't something you can recover from, so not clear what the point of that would really be to display on the login page. Seems like you'd want that to be a terminating condition for the whole request, which is definitely possible to do, so it doesn't go back to the login form but actually ends the whole process, either with a page or by returning to the SP with an error.

Out of the box, you really aren't assumed to configure the system in a way that this event could happen. So aside from it being something the code at least warns about and doesn't do anything "wrong" with, that's about as far as it goes by default.

I don't think in practice this should ever be allowed to happen, that's really the bottom line. One of the possible JAAS options should be attempted somehow/someway, I would think.

-- Scott