SPNEGO and _eventId_authn/SPNEGO button

Mon Mar 17 18:04:26 UTC 2025

On Mon, 2025-03-17 at 18:26:03 +0100, Cantor, Scott wrote:
> [...]
> > 3, Is it possible to disable the use of the spnego
> >-unavailable.vm view?
> 
> Looking at the code we were handed, I would have to think no, that's the view it renders to issue the WWW-Authenticate challenge.

I know very little of Spring. Well, the controller renders the
WWW-Authenticate challenge[1]. But I guess in a Spring MVC app
everything needs to use some sort of view and I guess using the "error
view" always[2] is good enough in this case. ^U

> > Right now it just flashes past because of the <body 
> > onLoad=""> but it would be nice to be able to avoid it
> > completely.
> 
> *Something* has to render to return the challenge, and you can make
> that view display anything you want, 

True and I did experiment with a errorUrl http-requiv=refresh only
template and while that did work I'm too lazy to implement it. I've
already spend far too much time on migrating from.. an older version...
= D

> [...] I would say that ultimately you're not going to end up doing any
> better than this in terms of a design. I think it has to be an "error"
> view to address the case of the browser not understanding the
> challenge since that's what it will end up rendering.

Totally agree and understand (dispite what I wrote first).

As always, thank you Scott for the help and explainations!

BR,
- Simon

1,
<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java;hb=4ade35a2bce3cf55d96b3ccd3709e3ea64843c6d#l401>
2,
<https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java;hb=4ade35a2bce3cf55d96b3ccd3709e3ea64843c6d#l417>