Different SessionIndex for each SP

[Cantor, Scott]

On 3/6/13 2:43 PM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:

>I think this SessionIndex combined with eduPersonTargetedID may be
>accidentally used to track users over SPs
>
>Is this intended?
>Is there any configuration option to use different SessionIndex for each
>SP?

It's a bug, I've fixed it already for the next release.

I didn't treat it particularly seriously for the simple fact that IP
address eliminates any pretense at non-collusion anyway. We don't want to
make the problem worse, but that's the most one can do.

I could be persuaded to treat it more seriously and do an advisory, but
every minute spent on that is one less spent coding for a very strapped
project. I'm not going to do a patch in any case, 2.4.0 is close to done
already and we don't maintain minor branches once a new minor is released.

-- Scott