SPNEGO and Luminis (aka integrated windows authentication)
We don't hot desk here at the University of Huddersfield. Each day we, the hard working staff of a noble Yorkshire institution, sit down at our familiar desk and login to our PC and then, oh tedious!, we have to login to the portal as well, using exactly the same credentials that we just entered to login to the PC! Wow, big waste of time! So say staff, and most importantly, so say management.
Well, there's a move afoot to get our desktops and the portal SPNEGO-ised so that it's immediate sign in to the portal - both Firefox (through a nice little add on) and IE support this, and I guess Chrome will surely do so soon. But is it difficult to do this? Anyone done it? I guess we'll need to have a different login point than the form based authentication but what else? Do we need to get into the jaas.conf file and write some authentication handlers (Java 6 supports SPNEGO apparently) or what?
At the moment we're not planning to give SPNEGO or IWA (it looks like MS did one of their 'embrace and extinguish' moves on SPNEGO - with interoperability a moot point) to the students but who knows. They are more liable, we suspect, of walking away from their computers without logging out, and doing so in public accessible areas, so it's a bit more of a security issue for them.So has anyone's got any advice, 'how we did it' stories, gotchas or warnings about SPNEGO and luminis? Excellent if you have - since I'm sure we're not the only institution with this being requested by our users.
Further developments
We've asked sungard about this, and although we've got the information that it is not currently supported, we have added this functionality as a request for a product enhancement, so perhaps it might be in a future version. I'm still very interested to know how this could be done - as a customised, unsupported (and broken by upgrades no doubt), hacking.