Question about session management in IdP 2.4.0

[Cantor, Scott]

On 4/25/13 6:52 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
>But what I don't understand if that one index may represent multiple
>sessions, for example in my previous example, IdP has added index
>"administrator" to two different sessions. The later one will replace the
>previous one in the SessionStore, then the only
> way to retrieve the old session is through session-id, not through other
>index. Am I understanding correctly? Did I miss anything on it?

No; it's broken.

>Then what is the purpose of these different kinds of index for each
>session?

Trying to handle logout without ever implementing it and determining the
design was incomplete.

The only reliable session lookup is by cookie. Nothing else will work
predictably.

-- Scott