Multi-Domain Multi-Server

[Greg Zapp]

Hmmm, right I see.  I was under the impression, somehow, that the cookie
contained some verifiable information from the idP/SP required to setup the
session.  Is there no way to accomplish this without a shared SP or session
storage?  I would think that if the second, physically separate, SP sends
me back to the idP it would be able to see that I was already authenticated
and just send me back with an assertion to the second ACS URL without
prompting for credentials.  Otherwise I may look into the tcp/ODBC options.

Unfortunately I don't have control over the idP, but I will certainly
enquire into multi-factor authentication on that end.

-Greg


On Fri, Jun 13, 2014 at 12:11 PM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Greg Zapp <greg.zapp at gmail.com> [2014-06-13 01:58]:
> > I read that setting "Domain=.domain.com;" as a cookie property may get
> what
> > I want as these share a common top-level domain?  Then I might just need
> to
> > associate multiple ACS endpoints with my relying party?
>
> If there's more than one server involved, though, and you don't intend
> to share the Shib SPs' sessions across those (e.g. via a shared shibd
> process or via ODBC) merely scoping the SP's session cookie to the
> common domain will not get you anywhere.
> The cookie is just a reference to a session in of of the SP's storage
> services, i.e. without a session at the server sharing the cookie
> across servers achieves nothing.
>
> > One particular site(the IIS) site uses multi-factor authentication
> > as well.. We may be able to modify this though to just accept the
> > shibboleth authenticated connection and then prompt for the token
> > before the application session is initiated.
>
> That's one way. The other would be to MFA-enable the IDP and let any
> SPs that care check the authnContextClass used.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140613/e37e14b1/attachment.html