Lost session

[Cantor, Scott]

On 9/3/13 9:01 PM, "Xiaoshu Wang" <xiaoshuw at email.unc.edu> wrote:
>
>The problem takes place when there is no valid Shibboleth session. I
>thought in that case, Shibboleth should just hand out what it gets to
>Glassfish. But apparently it does not. I have done the control.

There can be *no* forced session establishment if you don't have a setting
requiring one. It simply won't physically do that, so something else is
causing it, and presumably it must be something that specifically is
reacting to headers in some way.

>It is the same application run in each of these setting. So, it shows
>that somehow ShibUserHeader has interfered. Otherwise, it shouldn't give
>me the above result, right?

That all assumes nothing else in evidence. Since I know that's not what
the code does, the logical conclusion is that there's an external factor
involved.

-- Scott