ExternalAuth

[Nick Amon]

The cookie will be addressed bound but even if it wasn't why would it be worthless?  The same logic will apply, if the value of the cookie, a unique, random session ID, is found in the database, it is valid.   Even if the same cookie was presented to a different instace of our software, it wouldn't be accepted because presumably the session ID will not be in the database.  Am I misunderstanding something?

Thanks again for the responses.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 26, 2013 10:07 AM
To: Shib Users
Subject: Re: ExternalAuth

On 12/26/13, 9:58 AM, "Nick Amon" <namon at xceedium.com> wrote:

>Since the IdP and the External Auth Component reside on the same host 
>and both have access to the shared local database, as long as the 
>incoming request to the Idp Authentication engine has a valid PHP 
>session ID found in the database, then I know the request was authenticated successfully.
>Granted someone can steal the session ID from a valid user and reuse it 
>but the same can be said of the session ID used by the session 
>management component in the Idp.

Yes, if you're actually using the cookie as the exchange point and just looking up the session in the same database, that's fine.

Of course, the cookie needs to be address-bound or it's basically worthless, like any other cookie/bearer token.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net