maintaining SP shib state in cookie

[Jeremy Shapiro]

My organization is planning on using clustered SP's.  Our DNS ttl's are
high enough that using different SP's for the original request and the
authenticated request is not a concern.  What we do see in testing is that
Ajax requests from long-lived browser sessions can cause problems with
redirects when the resolved IP changes.  The proposed solutions in the wiki
(using private subnets for replications, shared database) won't work for us
for various reasons.  How feasible would it be for us to enhance
mod_shibboleth to store the session state in a cookie (a la pubcookie),
instead of a local cache.  Is this just a development effort (albeit a
large one) or are there security concerns with this approach?

   Jeremy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150514/dcde84fe/attachment.html>