browser private window activation condition

[Simon Lundström]

Sounds like using the activation condition way and look at the entity
ID's of the SPs the user is trying to login to and deny the ones you
know of is the most feasable one then.

BR,
- Simon

On Tue, 2025-02-18 at 12:19:57 +0100, Tunturi Timo wrote:
> Admin accounts are used to log in to dozens of SPs and I control only a handful of them. Even then users will use both regular and admin accounts on the same SPs so I don't see how that approach could work.
> 
> ________________________________________
> From: Simon Lundström <simlu at su.se>
> Sent: 18 February 2025 12:02
> To: Shib Users
> Cc: Tunturi Timo
> Subject: Re: browser private window activation condition
> 
> On Tue, 2025-02-18 at 10:10:19 +0100, Tunturi Timo via users wrote:
> > It's actually not for testing. We have separate admin accounts so
> > people need to be able to log in to the IdP with different accounts.
> > For their main account SPNEGO works fine but for admin login they'd
> > need a a way to disable SPNEGO.
> 
> Aaah. Do you control the SP? If so, make the SP use forceAuthn[1] and
> SPNEGO will be bypassed.
> 
> 1,
> <https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2076410043/ForceAuthn>
> 
> 
> BR,
> - Simon
> 
> > ________________________________________
> > From: Simon Lundström <simlu at su.se>
> > Sent: 18 February 2025 10:26
> > To: Shib Users
> > Cc: Tunturi Timo
> > Subject: Re: browser private window activation condition
> >
> > Hyvää huomenta Timo,
> >
> > I'm guessing this is for your own testing purposes?
> >
> > Firefox Private Window doesn't enable SPNEGO even if it's configured so
> > that's an option.
> >
> > If you have some user-agent sniffing allow list you can in your testing
> > browser window change to a user-agent that you don't support see
> > SPNEGOAuthnConfiguration and Activaction Condition[1].
> >
> > While I haven't dived into the whole MFA flow thing I'm guessing you can
> > in some of the first views (client-storage maybe?) add the JavaScript
> > and trigger/force a different flow?
> >
> > BR,
> > - Simon
> >
> > 1,
> > <https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506148/SPNEGOAuthnConfiguration#Configuration-of-an-Activation-Condition>
> >
> > ____________________________________
> >
> > Simon Lundström
> >
> > IT Services
> > Stockholm University
> > SE-106 91 Stockholm, Sweden
> >
> > http://www.su.se/staff/it
> >
> > https://www.su.se/english/about-this-website/privacy-policy
> >
> > On Tue, 2025-02-18 at 06:07:28 +0100, Tunturi Timo via users wrote:
> > > Hi,
> > >
> > > I'd like to use a browser private/incognito/inprivate/etc window activation condition for SPNEGO so that SPNEGO is never offered for browser private windows.
> > >
> > > Seems like such a detection would be done in browser-side javascript doing something like this: https://github.com/Joe12387/detectIncognito
> > >
> > > Is such interaction between server-side code and browser-side javascript possible? Or is there some other way to do what I want to do?
> > >
> > > -- Timo Tunturi / Aalto Uni
> > > --
> > > For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> > --
> > For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net