Multi-Domain Multi-Server

[Peter Schober]

* Greg Zapp <greg.zapp at gmail.com> [2014-06-13 01:58]:
> I read that setting "Domain=.domain.com;" as a cookie property may get what
> I want as these share a common top-level domain?  Then I might just need to
> associate multiple ACS endpoints with my relying party?

If there's more than one server involved, though, and you don't intend
to share the Shib SPs' sessions across those (e.g. via a shared shibd
process or via ODBC) merely scoping the SP's session cookie to the
common domain will not get you anywhere.
The cookie is just a reference to a session in of of the SP's storage
services, i.e. without a session at the server sharing the cookie
across servers achieves nothing.

> One particular site(the IIS) site uses multi-factor authentication
> as well.. We may be able to modify this though to just accept the
> shibboleth authenticated connection and then prompt for the token
> before the application session is initiated.

That's one way. The other would be to MFA-enable the IDP and let any
SPs that care check the authnContextClass used.
-peter