SPNEGO and _eventId_authn/SPNEGO button

Mon Mar 17 17:06:28 UTC 2025

On Mon, 2025-02-17 at 10:01:12 +0100, Simon Lundström via users wrote:
> [...] 
> I haven't found the time yet to investigate using the MFA flow so that's
> a to be continued.

Until now!

So basically what we want is:
* For the user to try authn/RemoteUser first which via Apaches
  mod_gssapi and a BrowserMatch enables "true" SPNEGO for browsers that
  behave well and don't put an NTLM auth popup when SPNEGO fails with
  GSSAPI (hello Firefox on all OSes and Safari on OS X and Chrome on
  !Windows)
* Then we go to authn/Password for the familiar login.vm which includes
  a "SPNEGO-button" which triggers the custom trySPNEGO event (took a
  while for me to understand the difference, or that there even is a
  difference, between flow and event tbh...)
* There if the user presses the "SPNEGO-button" we try the authn/SPNEGO
  flow and if that fails we go back to authn/Password with an error
  "flash".

We need to configure a custom event[1]:
authn/mfa-authn-config.xml:
<end-state id="trySPNEGO" />
<global-transitions>
<transition on="trySPNEGO" to="trySPNEGO" />
<transition on="#{!'proceed'.equals(currentEvent.id)}" to="InvalidEvent" />
</global-transitions>

Then we need to configure the MFA flow:
authn/mfa-authn-config.xml:
<util:map id="shibboleth.authn.MFA.TransitionMap">
<entry key="">
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" />
</entry>
<entry key="authn/RemoteUser">
<bean parent="shibboleth.authn.MFA.Transition">
<property name="nextFlowStrategyMap">
<map>
<entry key="ReselectFlow" value="authn/Password" />
</map>
</property>
</bean>
</entry>
<entry key="authn/Password">
<bean parent="shibboleth.authn.MFA.Transition">
<property name="nextFlowStrategyMap">
<map>
<entry key="trySPNEGO" value="authn/SPNEGO" />
</map>
</property>
</bean>
</entry>
<entry key="authn/SPNEGO">
<bean parent="shibboleth.authn.MFA.Transition">
<property name="nextFlowStrategyMap">
<map>
<entry key="ReselectFlow" value="authn/Password" />
</map>
</property>
</bean>
</entry>
</util:map>

And finally configure the IDP to use the MFA flow:
idp.properties:
idp.authn.flows = MFA
idp.authn.SPNEGO.enforceRun = true

Three questions:
1, Is this an a-OK and supported config? I mean, obviously it works but
so did how we did before in v3 which doesn't work in v5.
2, Why is enforceRun=true needed for SPNEGO to work at all? Even if the
flow is selected SPNEGO will never be tried unless SPNEGO is forced.
3, Is it possible to disable the use of the spnego-unavailable.vm view?
Right now it just flashes past because of the <body onLoad=""> but it
would be nice to be able to avoid it completely.

BR,
- Simon

1,
<https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534/MultiFactorAuthnConfiguration#Custom-Events>