Persistent Cookies with Shibboleth IDP?

[Byte Flinger]

I have made some tests myself using latest chrome and, at least with its
default cookie settings, it removed the cookie after closing it. Google was
not much help on the matter either other than an old thread where they say
it is not possible for securities reason.
I know that due to the open nature of Shibboleth I could literally just
change the code but I was thinking more along the lines of something
simpler like extending the username/password login handler. I thought the
idp_session cookie code was at Shibboleth's core but maybe I need to look
at the code again.
On Aug 5, 2013 10:39 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:

> Byte,
>
> > Is it possible to use persistent cookies with Shibboleth IDP (by default
> or custom code)
>
> I don't think it's possible by configuring the distribution using the
> username/password login handler, but you can do anything you want with
> custom code, obviously.
>
> > to keep the user logged in even after closing the browser?
>
> Just set a duration in the user's idp_session cookie(custom code) and make
> sure that user session objects are persisted for an equally long time in
> the IdP authentication handler and session manager(and sticky load balancer
> if used).
>
> You could also just use a custom login handler and handle all user login
> state there.
>
> That, or ask your users to use a "modern" browser that persists all
> session cookies anyway… ;D
>
> Thanks,
> Nate.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130805/9d6f4b00/attachment.html