login sequence --shib idp & sp/rp

[Cantor, Scott]

On 10/2/12 7:13 AM, "C G" <ci_98yr at yahoo.com> wrote:
>
>For the Shib-IDP part, does it set any cookie before redirecting?

It sets multiple cookies in different places, but that's an implementation
detail.

>How does SP/RP makes sure that userid that is authenticated is indeed the
>one to allow access to services? specifically how does provision for
>man-in-middle attack is addressed? (example flip user-id or stole cookie
>if there is one)

All user information is stored on the server side, and if it were in the
client it would be integrity protected.

As with any system not using HTTP authentication, the only session binding
is a cookie and unless you change settings, it's bound to the original
client's IP address. That's all the protection there is or can be unless
the client changes.

-- Scott