lazy sessions in shibboleth

[Peter Schober]

* samir el otmani <elotmani.samir at gmail.com> [2015-01-20 13:21]:
> i want to use lazy sessions to secure an application , so that the session
> management will be in the application , do you have any example to do that
> , and what is the security to use a passive protection.

I'm assuming you've read this?
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

For lazy sessions you set
 authType shibboleth
 require shibboleth

Which means the webserver will not enforce protection when someone
access your resources. You (i.e., your code or application) then is in
charge of intercepting such requests and initiating a session of your
own (application session), and in the process of doing that also
initiating a Shiboleth SP session, cf.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator

Whenever you want a client to initate an SP session you'll send them a
redirect (HTTP Location header) which points to the SP's Login
handler. E.g. /Shibboleth.sso/Login
You can also supply additional parameters, e.g. if you alraady know
the IDP to use: /Shibboleth.sso/Login?entityID=<urlencoded-idp-entity-id>
-peter