Question about session management in IdP 2.4.0

[Yaowen Tu]

Hi,

Not sure if it is a question to user list or dev list, I am just sending to
user list.

I am trying to get a deeper understanding about how IdP manages the session
for each user. For example if the same user log into the same SP at
different places, how IdP manage the sessions for this user.

Here is what I did:

1. Login as "administrator" in Firefox. In the log, I see:

Line 2991: 14:03:34.811 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl:173]
- Added index administrator to session
f448a6c60220b0df53925ff56dce64cb03b3dc13690e8c575bb6d7fa0d6939eb

Line 3661: 14:03:34.899 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl:173]
- Added index
administrator|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent|
https://XXX:8443/idp/shibboleth|http://XXX:8900/test to session
f448a6c60220b0df53925ff56dce64cb03b3dc13690e8c575bb6d7fa0d6939eb

2. Login as "administrator" in Chrome. In the log, I see:

Line 4358: 14:43:16.448 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl:173]
- Added index administrator to session
51c8167de0fca493651a204010c6719e95b1e68b21192d6fb7bdf64ae1a5cd2a

Line 4661: 14:43:34.899 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl:173]
- Added index
administrator|urn:oasis:names:tc:SAML:2.0:nameid-format:persistent|
https://XXX:8443/idp/shibboleth|http://XXX:8900/test to session
51c8167de0fca493651a204010c6719e95b1e68b21192d6fb7bdf64ae1a5cd2a


I am also looking at the source code. If I understand correctly, IdP will
create a session for each user who logs into each browser. Each session
will have multiple index, from what I see in the source code, index could
be principla name, session-id,
"principla-name|principal-format|NameQualifier|SPNameQualifier", and so on.
All the sessions will be stored in to a SessionStore, and is retrievable
using different kinds of index.

But what I don't understand if that one index may represent multiple
sessions, for example in my previous example, IdP has added index
"administrator" to two different sessions. The later one will replace the
previous one in the SessionStore, then the only way to retrieve the old
session is through session-id, not through other index. Am I understanding
correctly? Did I miss anything on it?

Then what is the purpose of these different kinds of index for each session?


Thanks,
Yaowen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130425/4d7ed426/attachment.html