Suggestions to handle IP Mismatch Issues

[ragadeep]

> I don't know what you mean by silently, but the SP doesn't have any
> built-in support for issuing Passive SSO requests in specific dynamic
> scenarios.

I meant if there was a way for SP to handle this without trying to re-initiate the session given certain network parameters like sessions expected from know network gateways.

 
> If you don't want any possibility of the user being prompted for a login
> if it happens, then you need to turn off address checking ....

Address checking seems like a best practice that I would prefer not to turn off if possible. 

> .... or you would need to stop using the SP session as the primary mechanism. 

Could you please elaborate on this or point me in the right direction?

> Passive/lazy session use pushes the job of responding to a session disappearing to the
> application and its session.
> 
> -- Scott

I'll look into using Passive/Lazy sessions and it might an approach we can try. We have an IdP initiated SSO setup and if the SP tries to initiate the session when address changes it won't work as the IdP will reject the request.

Thanks
Ragadeep



 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131211/66807349/attachment.html