shibboleth session management

[samir el otmani]

Hi shibboleth users ,

we have successfully implemented the lazy session, within our 'protected
application' , now the issue is how to achieve the following requirements :

1)we want to use shibboleth only for authentification so we want to fully
use the application Session.
2) there will be no shibboleth session with same 'uid' in another words ,
we have to maintain only one session for every uid connected (this is
implemented in application already using single sign out filter for CAS ).


i have the following code in filter , so that it redirect to SP when there
is no shib-session-id , but i think this code is not sufficient because
it's also rely on the shib-session-id from Headers :

        String shibSession = request.getHeader("Shib-Session-ID");
    if (StringUtils.isEmpty(shibSession)) {
    LOGGER.info("########## SHIB SESSION ######  " + shibSession);
    response.sendRedirect("
http://sp.example.com/Shibboleth.sso/Login?target=http://sp.exaple.com/App/
");
return;

    }

        else{
    filterChain.doFilter(request, response);
         LOGGER.info("########## END FILTER ##########");

    return;

        }
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150129/0ad9b650/attachment-0001.html