One or two sessions?

[Eirin Jenssen]

How do I get Shibboleth session to stick
to application's session (make them an unbreakable pair)?

 

If I test login with two different IDs (people)
in two different browsers and copies shibstate from one session to the other, I
get up the same result (data) in both browsers. (Session hicjacking)

 

Is this supposed to be allowed? I can
not find any documentation on Shibboleth for how to handle this. Can someone please
help me?
/Eirin
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151126/6853631c/attachment.html>