SPNEGO unavailability and error handling

[Wessel, Keith]

Hi, all,

We're again looking at enabling SPNEGO on our campus IdP. A couple questions:

1. The wiki is pretty clear about the potential negative user experience in Internet Explorer for users on devices not joined to the domain. It doesn't mention the user experience in other browsers, though. Does anyone know if other browsers simply report SPNEGO being unavailable and the IdP immediately displays the spnego-unavailable template?
2. Is there any easy way to get the IdP to simply display the IdP login page (fall through to the password authentication flow) if SPNEGO is unavailable? I know easy is relative, but I''m at a loss of any way to do it at all other than the activation conditions one can associate with the SPNEGO flow. For us, limiting to IP space is far from sufficient since we have so many devices not joined to the domain on our network.

Any thoughts/experiences welcomed.

Thanks,
Keith