Query on ECP implementation

[Cantor, Scott]

> 1). How is the session managed with ECP?

Sessions in ECP are somewhat loose since the client ultimately can authenticate autonomously, but if you were to handle cookies the IdP would issue them and use them in a fairly standard fashion, I believe.

> i see a property
> idp.session.StorageService = shibboleth.StorageService in idp.properties file.
> do i need to uncomment it to enable idp server side session management
> which perhaps will store session identifier on some file at IDP.

If you had the local-storage option turned off, the cookie-based client session service would work with it.

> 2). How can i get the refreshed attributes after some time ?  Will i have to
> perform AuthnRequest again, coz to me it seems it will create a new IDP
> session every time. Will the AttributeQuery work here, passing the nameid
> returned in the AuthnResponse ?

SAML SSO flows are time of authentication and there is no "refresh" notion built in.

-- Scott