Shib login in pop-up browser window?

[Cantor, Scott]

On 10/16/14, 7:46 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:

>Do you know if suppressing the UI (isPassive=True) would still generate
>this error authenticating within an iframe? I suspect yes, but was
>wondering if you
> have more direct evidence from your recent experience.

It should. The passive eval is done inside the AuthenticationEngine, so
that's after the login context is set and after it gets read back in
there. The context is the handoff between the profile handlers and the
authn portion, so it crosses servlets.

V3 isn't changing this BTW. Webflow relies on the JSESSIONID cookie for
the conversation state, so everything is ultimately hung off it. However,
I suppose the support some containers have for putting JSESSIONID on the
URL might trump that.

The IdP won't rely on any *other* cookies except for its own session, and
that session is purely optional from the PoV of getting a request to work.
So I suppose if the JSESSIONID on the URL worked, you'd lose SSO but it
should honor a request. Progress of a sort I guess. But I suspect there
will be code changes needed to get that to actually work.

-- Scott