Backchannel Notify and NameID bound sessions

[Cantor, Scott]

On 3/21/12 8:32 AM, "Harald Strack" <hstrack at ssystems.de> wrote:
>
>sorry for my late answer... but I became father... :-)

That's a good excuse.

>I thought that I configured the SLO in a standard way!  The multiple IDP
>Sessions are very common in our environment as users have so many
>devices (notebook, workstation, tablet, smartphone...). May there be a
>way to use a dedicated NameID for every IDP-Session / Device of a user,
>so that we end up in a 1:1 relation of NameIDs and Sessions?

The IdP's transientID support has a bug that causes it to reuse transients
within the TTL of the transient mapping if the same SP makes a request of
the same user. One solution is to use the crypto plugins for transientID
handling, and that results in a guaranteed different NameID each time.

-- Scott