SPNEGO unavailability and error handling

[Cantor, Scott]

On 9/26/19, 4:51 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> 2. Is there any easy way to get the IdP to simply display the IdP login page (fall through to the password authentication
> flow) if SPNEGO is unavailable?

It's primarily built to run *from* the Password flow using a button to opt into it, that's my recollection. I think it would return there afterwards if it failed.

When it's run directly, there's an auto login option that has to be on, and if it fails then, it just fails. It returns control to the IdP and whatever is next in line will run. SPNEGO|Password with that autologin on would do what you're talking about, I think.

None of this was built with the MFA flow around and things will probably go nuts when it's all mixed together, but I would expect running SPNEGO first with autologin, and then really anything else after if that fails might work.

-- Scott