Which variable determines an active current shibboleth session?

[Cantor, Scott]

On 8/24/11 9:05 PM, "Peterson, Tommy" <Tommy.Peterson at xpandcorp.com> wrote:
>
>One last question. If I want a unique session ID for each authenticated
>user I would use Shib-Session-ID, which will also be present for each
>valid Shibboleth session, correct?

You can do that, yes. The only caveat is that not being able to guess
those session IDs is the only real security in the system in many
deployments, so if you were to expose them in some way inadvertently such
that somebody else could see them, that could be a problem.

-- Scott