SPNEGO and _eventId_authn/SPNEGO button

Mon Mar 17 17:26:03 UTC 2025

> 1, Is this an a-OK and supported config? I mean, obviously it
> works but so did how we did before in v3 which doesn't work
> in v5.

It may well just work again in 5.1.4 soon, but as far as the MFA usage, that all looks simple enough to me to be "normal/routine".

Anything you can make the MFA flow do with the API we have is "supported" at the end of the day.

> 2, Why is enforceRun=true needed for SPNEGO to work at
> all? Even if the flow is selected SPNEGO will never be tried
> unless SPNEGO is forced.

Something related to all that crazy machinery around "auto-login", it had some convoluted rules about when all that runs, and they're applying to this situation. I would say setting the property is a reasonable thing to do if it behaves the way it's meant to when it's set. Setting that auto-login cookie would I think also get it to run.

> 3, Is it possible to disable the use of the spnego
>-unavailable.vm view?

Looking at the code we were handed, I would have to think no, that's the view it renders to issue the WWW-Authenticate challenge.

> Right now it just flashes past because of the <body 
> onLoad=""> but it would be nice to be able to avoid it
> completely.

*Something* has to render to return the challenge, and you can make that view display anything you want, so I would say that ultimately you're not going to end up doing any better than this in terms of a design. I think it has to be an "error" view to address the case of the browser not understanding the challenge since that's what it will end up rendering.

-- Scott