Questions starting to implement Shibboleth IDP

[Cantor, Scott]

> Are the web user's cookies available to the authentication mechanism?  If
> they are then it would be fairly easy to determine that they have already
> logged on.

The cookies available are the ones authorized by the client to send to whatever server the IdP runs on based on the cookie properties the server set. That's just how cookies work.
 
-- Scott