[JIRA] Updated: (IDP-90) Ensure transients are per-session

[Chad La Joie (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/IDP-90?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chad La Joie updated IDP-90:
----------------------------

    Component/s: SAML2
                 SAML1

> Ensure transients are per-session
> ---------------------------------
>
>                 Key: IDP-90
>                 URL: https://issues.shibboleth.net/jira/browse/IDP-90
>             Project: Identity Provider
>          Issue Type: Improvement
>          Components: SAML1, SAML2
>            Reporter: Scott Cantor
>            Assignee: Chad La Joie
>            Priority: Minor
>
> Current IdP behavior with the default transientID attribute def reuses transients for the TTL of the handles with the same RP. This allows correlation when there shouldn't be any, but is currently difficult to fix because this behavior ensures strongly matching NameIDs in queries.
> We need to change the behavior so that the transient is different on each resolution run, but make the queries "pin" the inbound NameID into the assertions going back. We'll track multiple transients per principal/RP pair, as opposed to one like now. 

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira