lazy sessions in shibboleth

[samir el otmani]

thank you Peter for the help

2015-01-20 12:50 GMT+00:00 Peter Schober <peter.schober at univie.ac.at>:

> * samir el otmani <elotmani.samir at gmail.com> [2015-01-20 13:21]:
> > i want to use lazy sessions to secure an application , so that the
> session
> > management will be in the application , do you have any example to do
> that
> > , and what is the security to use a passive protection.
>
> I'm assuming you've read this?
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
>
> For lazy sessions you set
>  authType shibboleth
>  require shibboleth
>
> Which means the webserver will not enforce protection when someone
> access your resources. You (i.e., your code or application) then is in
> charge of intercepting such requests and initiating a session of your
> own (application session), and in the process of doing that also
> initiating a Shiboleth SP session, cf.
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator
>
> Whenever you want a client to initate an SP session you'll send them a
> redirect (HTTP Location header) which points to the SP's Login
> handler. E.g. /Shibboleth.sso/Login
> You can also supply additional parameters, e.g. if you alraady know
> the IDP to use: /Shibboleth.sso/Login?entityID=<urlencoded-idp-entity-id>
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
*EL OTMANI Samir*
*Ingénieur d'Etat en Génie Informatique *
*Tel:+212 699 041 864*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150120/33fac326/attachment.html