IdP Stateless Clustering / External SSO

[Cantor, Scott]

On 7/18/12 7:57 PM, "Derek Yuen" <derek.yuen at mail.utoronto.ca> wrote:

>Looking at the IdP Stateless Clustering article, I'm wondering:
>   Is it necessary to implement the CryptoTransientPrincipalConnector if
>my cluster of IdPs if they're configured with an external SSO (i.e.
>CAS/Pubcookie)?

That doesn't really have anything to do with the question. The only factor
is whether you have a requirement to reverse map the transients, such as
in an attribute query. Any deployment in which you don't have to reverse
the mapping or issue logout messages using a NameID or something like that
doesn't even need to generate a NameID at all, let along have a principal
connector (of any type).

>I understand that replay detection would work just fine if the user got
>the same IdP.
>How might the replay function be different if the user got a different
>IdP 
>[which wouldn't have the users' principals] and if the
>CryptoTransientPrincipalConnector was not implemented?

I don't understand what replay you're referring to.

-- Scott