cookieless SP

[Pascal Rigaux]

Hi,

I'm trying to have Shibboleth SP work without cookies.
A solution is to pass session_id in relayState url.
The attached patch is a proof of concept how it can be done.
What do you think of such a feature? Could it be added (with a config var to enable it)?


Some details:

* Rationale for cookieless SP:

With "Single Page Application"s where everythig except login is done in Ajax/CORS,
it is quite easy to pass sessionid in HTTP header.
If needed shibsession can easily be passed via a "inboundHeader".

If you embed such an app in a iframe, third party cookies may be refused (esp. by safari)
whereas IDP cookies will usually be accepted in case the user is already logged.

The problem is the login done in browser, the redirect from SP to application relies on shibsession cookie.


* Alternative solution

Instead of passing shibsession in url, it would be possible for shibd to do the request on final RelayState.
(the final redirect would be internally done in shibd, a la mod-rewrite)

A similar solution would be an alternative end-point that would:
- curl the real end-point, get the "Location" & "Set-Cookie" from answer
- curl the relayState and return the answer to the user


Thanks for reading and thanks for great products :)
-- 
Pascal Rigaux

-- 
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: handle-and-pass-shibsession-in-url.patch
Type: text/x-patch
Size: 7373 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20140712/746a80ea/attachment.bin