Shibboleth library shutting down several times per day

[Cantor, Scott]

On 11/11/13, 9:23 AM, "MikeWho" <who at me.com> wrote:
>
>Most of our testers are in one office (and thus their traffic comes from
>one
>external IP address) whereas a few external testers have different IP
>addresses. If both use the same login credentials, would one or both have
>their session invalidated? (checkAddress is set to true). I've just seen a
>few address mismatch log entries.

I'm sure that's the reason, but they won't interfere with each other, it's
about the session, not the user.

If the routing to the IdP and SP differs, then you can't generally keep
checkAddress on.

If the addresses change mid-session, then you have a real problem and have
to decide whether to make the cookie security truly awful and turn off
consistentAddress, or get people to fix their network.

-- Scott