browser private window activation condition

[Tunturi Timo]

It's actually not for testing. We have separate admin accounts so people need to be able to log in to the IdP with different accounts. For their main account SPNEGO works fine but for admin login they'd need a a way to disable SPNEGO.

I know that on Firefox private mode disables SPNEGO but this varies from browser to browser and platform to platform. Also we use WebAuthn for admin accounts and Firefox works poorly with that. Chrome is generally the best browser for WebAuthn across all platforms but for instance on Windows it will do SPNEGO even in an incognito window.

- Timo

________________________________________
From: Simon Lundström <simlu at su.se>
Sent: 18 February 2025 10:26
To: Shib Users
Cc: Tunturi Timo
Subject: Re: browser private window activation condition

Hyvää huomenta Timo,

I'm guessing this is for your own testing purposes?

Firefox Private Window doesn't enable SPNEGO even if it's configured so
that's an option.

If you have some user-agent sniffing allow list you can in your testing
browser window change to a user-agent that you don't support see
SPNEGOAuthnConfiguration and Activaction Condition[1].

While I haven't dived into the whole MFA flow thing I'm guessing you can
in some of the first views (client-storage maybe?) add the JavaScript
and trigger/force a different flow?

BR,
- Simon

1,
<https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506148/SPNEGOAuthnConfiguration#Configuration-of-an-Activation-Condition>

____________________________________

Simon Lundström

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

http://www.su.se/staff/it

https://www.su.se/english/about-this-website/privacy-policy

On Tue, 2025-02-18 at 06:07:28 +0100, Tunturi Timo via users wrote:
> Hi,
>
> I'd like to use a browser private/incognito/inprivate/etc window activation condition for SPNEGO so that SPNEGO is never offered for browser private windows.
>
> Seems like such a detection would be done in browser-side javascript doing something like this: https://github.com/Joe12387/detectIncognito
>
> Is such interaction between server-side code and browser-side javascript possible? Or is there some other way to do what I want to do?
>
> -- Timo Tunturi / Aalto Uni
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net