SPNEGO login flow: Enforce SPNEGO by condition

[Cantor, Scott]

On 12/2/15, 6:59 AM, "dev on behalf of Daniel Lutz" <dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:


>
>The auto-login cookie is set by a common cookie management component
>of the IdP. The lifetime of these cookies can be set by the
>global property "idp.cookie.maxAge" in conf/idp.properties. The default
>value is one year (31536000).
>
>As the current implementation makes use of the common cookie management
>component, it's currently not possible to specify an individual lifetime
>for the SPNEGO auto-login cookie.

Well, the property is shared, but actually the component isn't. I split off the cookie manager into a separate one so that the HttpOnly flag could be unset for these prefs, allowing simple JavaScript to manipulate them. I didn't create a separate property set to tweak it, but we could.

-- Scott