Applications that autorefresh

[Cantor, Scott]

On 7/16/12 5:36 PM, "Chad La Joie" <lajoie at itumi.biz> wrote:

>Well, if the SP is redirecting automatically that means they're using
>eager sessions.  I would recommend changing the SP to use lazy
>sessions and to display a "Your session has timed out, please click
>here to login again" page when appropriate.

That's generally what I would advise.

>To your other question, the IdP's profile handlers and its
>authentication engine are separate things.  What you're suggesting
>would require that the authentication engine understand the serialized
>state and know how to deserialize it.  That would make an already
>complex beast (the authentication engine) more complex and would
>prevent new protocols from being added to the IdP without updating the
>authentication engine as well.

Could it serialize "basic" state of a request such that if it had to be
recovered from that serialized form, some protocols and features would
work and others wouldn't? Most protocols have a small, and identical, set
of basic features that map to common primitives (like the "return"
location, relay state, etc.).

-- Scott