shibboleth session management

[Cantor, Scott]

> 1)we want to use shibboleth only for authentification so we want to fully use
> the application Session.

You can only do that within limits. The SP session has to exist long enough for one resource request to a resource that establishes your application session. After that, you can do whatever you want.

> 2) there will be no shibboleth session with same 'uid' in another words , we
> have to maintain only one session for every uid connected (this is
> implemented in application already using single sign out filter for CAS ).

The SP doesn't support anything like that.

> i have the following code in filter , so that it redirect to SP when there is no
> shib-session-id , but i think this code is not sufficient because it's also rely on
> the shib-session-id from Headers :

I don't understand what you're asking, but in general checking for any of the built-in SP headers that are set for a session is an acceptable way to tell whether there's an SP session.

-- Scott