2 SP's, Domain cookie + host cookie conflicts?

[Michael Berkowski]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello everyone,

We are experimenting with a new setup involving a domain cookie to share 
sessions between multiple VirtualHosts on a server. Based on some older 
recommendations of using an unsupported domain cookie
(http://marc.info/?l=shibboleth-users&m=122304499606277&w=2) I am seeing 
success between the vhosts.  They seem to reliably load the correct user 
session based on the domain cookie received. We may move forward with the 
domain cookie in that regard.

However, I am concerned about its impact on *other* SPs residing on different 
servers under the same domain, which would be receiving the domain cookie in 
addition to their own valid host cookies.

Consider the setup:

entityId1.example.com has 2 virtualhosts, and sets a cookie for example.com
VirtualHosts:
- - vh1.example.com
- - vh2.example.com

entityId2.example.com runs its own SP and sets a cookie for sub.example.com
VirtualHosts:
- - other.example.com

Users authenticating to either vh1 or vh2 have the example.com _shibsession_* 
cookie. The same users later establishing a session other.example.com now have 
both cookies and the example.com cookie is sent to other.example.com where the 
session it identifies doesn't exist.

Preliminary testing has been promising, but we recognize this is not a 
supported behavior. Is it likely that other.example.com can correctly 
negotiate the two cookies and choose the one which identifies a valid session 
on that server every time?  Will it attempt to load sessions from both cookies 
and safely ignore the example.com session?


Thanks for your input,
- -- 
++++++++++++++++++++
Michael Berkowski
University of Minnesota Libraries
mjb at umn.edu
612.626.6137
PGP Public Key: http://z.umn.edu/mjbpubkey
++++++++++++++++++++

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlW2edwACgkQ01KJk46VC2Zh8QCdHsEalQ7wLtbFuCoNcCZtrUba
Wf4An3yVTs/X77xlvI2felKUex78mRMb
=AjH9
-----END PGP SIGNATURE-----