_check_is_passive a second time on re-visit

[Martin Haase]

Hi list,
I had been thinking about this back and forht, without a good solution.
The problem: We have two apps with isPassive enabled, say A and B. User
comes in via A, A does ispassive check, user is not logged in. User
changes to B (there ispassive check and not logged-in, but that's
irrelevant), and decides to log in at a given point. When he comes back
to A, the cookie according to
https://wiki.shibboleth.net/confluence/display/SHIB2/isPassive has been
set already, thus A does not try the isPassive check anymore. However,
I'd rather not force the user to explicitly log-in there but issue
another passive check automatically.
We tried with short cookie lifetimes, but this has two drawbacks:
needlessly frequent isPassive requests causing SP and IdP load, and loss
of session (e.g. half-filled POST forms) when the cookie expires. And
the usage of separate paths, one issuing isPassive requests and the
other not, but the case looks like I must assume the paths are the same.
What other measures can you think of? E.g. can one detect when a user
leaves one host (sorry if that sounds lika a silly question)?
Cheers,
Martin

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-6
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2345 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20140214/91434893/attachment-0001.bin