IDP v3 Double Login

Cantor, Scott cantor.2 at
Tue Aug 4 11:41:43 EDT 2015

On 8/4/15, 11:36 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at on behalf of mckeanbs at> wrote:

>I find that a bit confusing. Initially you were saying it'd be caused by SP behavior, but then then that no settings would cause that behavior. Do you mean Shibboleth SP has no settings that might cause that in general? I suppose I can't rule out that they have since switched away from Shibboleth SP.

Either the SP is making a second request or it's not. If a double login is happening entirely within a single request to the IdP, then the SP obviously isn't even involved. If the SP is involved, then whatever they made it do is something that they should be able to identify, but it's nothing the SP does intrinsically.

>And if so, is there any setting on the IDP side that might coax it into behaving better?

Since I have no idea what either end is really doing, I certainly couldn't say anything about how to fix it. If the SP is making two requests, then there should be a meaningful difference between them (like one specifying IsPassive and the other not). If there's a difference, then it can be determined what bug might be getting triggered or if there's a misconfiguration.

-- Scott

More information about the users mailing list