Shibboleth session vs Application session

[Cantor, Scott]

On 12/4/14, 9:23 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:



>Thanks for your reply. I wanted to additionally clarify the following:
> 
>We are planning to use WebLogic SAML integration. Additionally, since our 
>existing application uses container sessions extensively, we will be 
>using our application session instead of the Shibboleth session.

As Kevin said, then there is no Shibboleth session if you're not using the 
Shibboleth software.

Unless you mean the IdP, but that's much more complicated, now you're 
talking about SSO and those implications. That doesn't comport with any 
kind of control at the SP end. If you need that kind of control, you have 
to use ForceAuthn, and open that can of worms (cue Eric), or it doesn't 
matter what you do at the SP end.

With respect to the PCI statement, that is fundamentally at odds with SSO 
because it assumes that a timeout at the application end guarantees the 
ability to "force" reauthentication. So again, that's ForceAuthn, and few 
IdPs are going to give you that with any reliability.

-- Scott