browser private window activation condition

[Simon Lundström]

On Tue, 2025-02-18 at 10:10:19 +0100, Tunturi Timo via users wrote:
> It's actually not for testing. We have separate admin accounts so
> people need to be able to log in to the IdP with different accounts.
> For their main account SPNEGO works fine but for admin login they'd
> need a a way to disable SPNEGO.

Aaah. Do you control the SP? If so, make the SP use forceAuthn[1] and
SPNEGO will be bypassed.

1,
<https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2076410043/ForceAuthn>


BR,
- Simon

> ________________________________________
> From: Simon Lundström <simlu at su.se>
> Sent: 18 February 2025 10:26
> To: Shib Users
> Cc: Tunturi Timo
> Subject: Re: browser private window activation condition
> 
> Hyvää huomenta Timo,
> 
> I'm guessing this is for your own testing purposes?
> 
> Firefox Private Window doesn't enable SPNEGO even if it's configured so
> that's an option.
> 
> If you have some user-agent sniffing allow list you can in your testing
> browser window change to a user-agent that you don't support see
> SPNEGOAuthnConfiguration and Activaction Condition[1].
> 
> While I haven't dived into the whole MFA flow thing I'm guessing you can
> in some of the first views (client-storage maybe?) add the JavaScript
> and trigger/force a different flow?
> 
> BR,
> - Simon
> 
> 1,
> <https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506148/SPNEGOAuthnConfiguration#Configuration-of-an-Activation-Condition>
> 
> ____________________________________
> 
> Simon Lundström
> 
> IT Services
> Stockholm University
> SE-106 91 Stockholm, Sweden
> 
> http://www.su.se/staff/it
> 
> https://www.su.se/english/about-this-website/privacy-policy
> 
> On Tue, 2025-02-18 at 06:07:28 +0100, Tunturi Timo via users wrote:
> > Hi,
> >
> > I'd like to use a browser private/incognito/inprivate/etc window activation condition for SPNEGO so that SPNEGO is never offered for browser private windows.
> >
> > Seems like such a detection would be done in browser-side javascript doing something like this: https://github.com/Joe12387/detectIncognito
> >
> > Is such interaction between server-side code and browser-side javascript possible? Or is there some other way to do what I want to do?
> >
> > -- Timo Tunturi / Aalto Uni
> > --
> > For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net