Refresh idp session in Ajax based SP

[Jim Fox]

One way to handle this problem is to maintain your own sessions.  That way 
your javascript can easily detect session timeouts and deal with them 
appropriately.

If you use password authentication you have to use a password to refresh 
an idp session.  And if you care about your users you have to let them 
enter that password at the idp--not allow the application to collect it.

To my mind an iframe login is just as bad.  You give your users no means 
to identify the site that is requesting the password.  You are, in 
essence, trusting the application with the password.

Jim

>
> We use shibboleth idp3 as sso solution for multiple applications (SPs). We have custom saml filter + consumption servlet managing forwards and communication with idp.
> Now one of the applications uses Ajax heavily so it's common that users stays at one page for a long time and despite user's activity there's no redirect to idp (our filter passes Ajax calls as they cannot manage redirect + saml response page/form).
> So what happens is that idp session expires (after configured timeout) and later when user clicks to different page the login page appears - after redirect to idp.
>
> Is there a way how idp session can be refreshed via Ajax/js call? I guess idp code seeks the session via standard servlet session or (which is) using cookie. And it probably cannot be read without visiting idp page.
>
> Was also thinking about adding iframe to the page with saml request directly to SSO idp flow - if cookie is used the iframe would get even login form or saml response form with js autosubmit.
>
> Could back channel query be used to refresh the session? Didn't find much documentation on this but my understanding is this is SOAP web service to query response attributes. Not sure what input parameters are and if such call matches & refresh the session.
>
> Thanks for any hints
> Petr
>
>
> This message is from DHL Information Services (Europe) s.r.o. and may contain confidential business information. It is intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient please contact the sender and delete this message and any attachment from your system. Unauthorized publication, use, dissemination, forwarding, printing or copying of this email and its attachments is strictly prohibited.
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>