<div dir="ltr">You can avoid the initial selection screen by setting an InitialAuthContext that maps to your username/password context. In our implementation, we have three contexts in play for some users. To eliminate the chooser screen for them, we modified our selectcontext.vm file to contain a bit of javascript that when window.onload() fires, it submits the chooser form automatically back to the IdP with our 2FA context pre-selected. The JS works pretty well, though we've found it breaks users trying to install the Box Sync and Box Office applications on windows machines (for some reason the embedded browser won't run the JS).<div><br></div><div>Dave</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 30, 2015 at 9:22 PM, Ewing, Bill <span dir="ltr"><<a href="mailto:BEwing@utsystem.edu" target="_blank">BEwing@utsystem.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks for the response. I tried the new version this evening and while it did get me to the sp w/o an AuthnFailed message we did get stopped with an authentication
selection screen where we have to select our authcontext ie 2factor, username/password only. Is there some additional config that can be done to get through w/o getting the selection screen?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Bill<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Tuesday, June 30, 2015 2:59 PM<br>
<b>To:</b> Shibboleth Users<br>
<b>Subject:</b> Re: When using IDP 2.4.4 and MCB 1.2.5 we are seeing AuthnFailed message after authenticating to one sp then switching to a new tab with an sp that forces reauth
<u></u><u></u></span></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Grab version 1.2.6 to fix that bug. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Paul<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jun 30, 2015, at 3:50 PM, Ewing, Bill <<a href="mailto:BEwing@utsystem.edu" target="_blank">BEwing@utsystem.edu</a>> wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Trebuchet MS",sans-serif">Ever since we’ve started using the IDP 2.4.4 and MCB 1.2.5 in preparation for rolling out 2factor we have our users seeing the AuthnFailed message when after authenticating
to one sp previously opens a new browser tab and visits an sp that is set to force re-authentication. One of our other schools with a similar setup disabled their setup for previous sessions to get around this issue. We were wondering if this was a known issue
for this scenario or are we missing something with our config on the sp or idp possibly? I’ll paste the idp log snippet below</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">-----<br>
Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com" target="_blank">paul.hethmon@clareitysecurity.com</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div>David Langenberg<div>Identity & Access Management Architect</div><div>The University of Chicago</div></div></div></div>
</div>