ExternalAuth

[Cantor, Scott]

On 12/26/13, 9:58 AM, "Nick Amon" <namon at xceedium.com> wrote:

>Since the IdP and the External Auth Component reside on the same host and
>both have access to the shared local database, as long as the incoming
>request to the Idp Authentication engine has a valid PHP session ID found
>in the database, then I know the request was authenticated successfully.
>Granted someone can steal the session ID from a valid user and reuse it
>but the same can be said of the session ID used by the session management
>component in the Idp.

Yes, if you're actually using the cookie as the exchange point and just
looking up the session in the same database, that's fine.

Of course, the cookie needs to be address-bound or it's basically
worthless, like any other cookie/bearer token.

-- Scott