Different SessionIndex for each SP

[Takeshi NISHIMURA]

Thanks for your quick response, Scott!

On 2013/03/07, at 4:49, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 3/6/13 2:43 PM, "Takeshi NISHIMURA" <takeshi at nii.ac.jp> wrote:
> 
>> I think this SessionIndex combined with eduPersonTargetedID may be
>> accidentally used to track users over SPs
>> 
>> Is this intended?
>> Is there any configuration option to use different SessionIndex for each
>> SP?
> 
> It's a bug, I've fixed it already for the next release.
> 
> I didn't treat it particularly seriously for the simple fact that IP
> address eliminates any pretense at non-collusion anyway. We don't want to
> make the problem worse, but that's the most one can do.
> 
> I could be persuaded to treat it more seriously and do an advisory, but
> every minute spent on that is one less spent coding for a very strapped
> project. I'm not going to do a patch in any case, 2.4.0 is close to done
> already and we don't maintain minor branches once a new minor is released.
> 
> -- Scott