browser private window activation condition

[Simon Lundström]

To be honest you don't even need to control the SP; the SP just needs to
support forceAuth and for the Shibboleth SP you can just add
?forceAuthn=true to the Session Initiator URL like:
Instead of https://sp-test.it.su.se/Shibboleth.sso/SWAMID just add
https://sp-test.it.su.se/Shibboleth.sso/SWAMID?forceAuthn=true

So you basically just need to control the link where the user clicks the link
from.

But if you control the SPs configuration you can make forceAuthn=true
the default.

BR,
- Simon

On Tue, 2025-02-18 at 10:10:19 +0100, Tunturi Timo via users wrote:
> It's actually not for testing. We have separate admin accounts so people need to be able to log in to the IdP with different accounts. For their main account SPNEGO works fine but for admin login they'd need a a way to disable SPNEGO.
> 
> I know that on Firefox private mode disables SPNEGO but this varies from browser to browser and platform to platform. Also we use WebAuthn for admin accounts and Firefox works poorly with that. Chrome is generally the best browser for WebAuthn across all platforms but for instance on Windows it will do SPNEGO even in an incognito window.
> 
> - Timo
> 
> ________________________________________
> From: Simon Lundström <simlu at su.se>
> Sent: 18 February 2025 10:26
> To: Shib Users
> Cc: Tunturi Timo
> Subject: Re: browser private window activation condition
> 
> Hyvää huomenta Timo,
> 
> I'm guessing this is for your own testing purposes?
> 
> Firefox Private Window doesn't enable SPNEGO even if it's configured so
> that's an option.
> 
> If you have some user-agent sniffing allow list you can in your testing
> browser window change to a user-agent that you don't support see
> SPNEGOAuthnConfiguration and Activaction Condition[1].
> 
> While I haven't dived into the whole MFA flow thing I'm guessing you can
> in some of the first views (client-storage maybe?) add the JavaScript
> and trigger/force a different flow?
> 
> BR,
> - Simon
> 
> 1,
> <https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506148/SPNEGOAuthnConfiguration#Configuration-of-an-Activation-Condition>
> 
> ____________________________________
> 
> Simon Lundström
> 
> IT Services
> Stockholm University
> SE-106 91 Stockholm, Sweden
> 
> http://www.su.se/staff/it
> 
> https://www.su.se/english/about-this-website/privacy-policy
> 
> On Tue, 2025-02-18 at 06:07:28 +0100, Tunturi Timo via users wrote:
> > Hi,
> >
> > I'd like to use a browser private/incognito/inprivate/etc window activation condition for SPNEGO so that SPNEGO is never offered for browser private windows.
> >
> > Seems like such a detection would be done in browser-side javascript doing something like this: https://github.com/Joe12387/detectIncognito
> >
> > Is such interaction between server-side code and browser-side javascript possible? Or is there some other way to do what I want to do?
> >
> > -- Timo Tunturi / Aalto Uni
> > --
> > For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net