Possible to disable the invoking of Login/Logout handlers via browser address bar?

[Andrew Webb]

How should your webserver determine whether a GET request was issued
> by a HTTP User Agent after recieving a "Location" HTTP header issued
> by your server or by that user agent simply GET'ing that same URL
> without such a prior exchange?

One way might be to use a cookie set by my website in its redirect response,
and read by Shibboleth SP.  Another way might be to a) timestamp the request
and b) sign it - similar to a SAML authn request.  I'm not necessarily
promoting these things; I'm just saying that there are ways.



 If you don't want certain users or groups not to be
> able to access certain parts of the site it's your applications job
> (since you're using lazy sessions) to make sure of that.

All users/groups can access all parts of the site.  But /this/ group of
users really should use IdP A, while another group should use IdP B.  It's
not terrible if a user in one group manipulates the address in the address
bar to target the wrong IdP... but it would be nice to prohibit it.

Aside from GETting /Shibboleth.sso/Login and Logout, is there another (more
programmatic) way I can initiate / terminate session via Shib?




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Possible-to-disable-the-invoking-of-Login-Logout-handlers-via-browser-address-bar-tp7581455p7581457.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.