Issue in Authentication of user with Shibboleth Cookie

[Scott Koranda]

> "Client address is <<ip adddress>> but session <<cookie>> already
> bound to <<ipaddress(differnt from the ip address which is mentioned
> client address is >>"

This issue has nothing to do with the ECP profile. It is the same issue
regardless if you are using an ECP client or a normal web browser and
the standard Web SSO Profile.

The Shibboleth SP session by default is bound to the IP address for the
client. If that IP address changes then the SP session is invalidated.

Further by default the Shibboleth SP session is bound to the client IP
address that the IdP saw when it authenticated the user. So if the
client IP address that the IdP and SP see are different the SP will not
by default create a session.

Both behaviors are configurable but have security implications. Please
be sure to study and understand the security implications before
changing the default behavior.

The configuration options are

checkAddress

and

consistentAddress

on this wiki page:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

Scott K