Why Shibboleth SET a cookie to a browser and Shibboleth multi domain support

[Cantor, Scott]

On 8/15/11 11:21 PM, "Michael Furman" <furman.michael at gmail.com> wrote:
>1) According to my understanding the SAML protocol does not define how
>the information from the assertion is added to a browser.

That's correct.

>So, please clarify me if Set-Cookie is part of SAML2 protocol or it is
>addition of Shibboleth to set the state of SAML2 authentication in a
>browser.

Session handling is outside the scope of the standard.

> 
>2) What happens if my application accesses other DNS domain?

The SP at that domain repeats the process.

>According to my knowledge a browser will not send a cookie.
>How Shibboleth solves this problem?

It doesn't. Web SSO is the act of creating a session with one domain based
on a session with another.

-- Scott