One or two sessions?

[Cantor, Scott]

On 11/26/15, 5:31 AM, "users on behalf of Eirin Jenssen" <users-bounces at shibboleth.net on behalf of eirinj at hotmail.com> wrote:



>How do I get Shibboleth session to stick to application's session (make them an unbreakable pair)?

Write code, I guess.

> 
>If I test login with two different IDs (people) in two different browsers and copies shibstate from one session to the other, I get up the same result (data) in both browsers.

If you're sharing IP addresses.

> (Session hicjacking)
> 
>Is this supposed to be allowed?

No, because IP address checking is enabled by default.

> I can not find any documentation on Shibboleth for how to handle this. Can someone please help me?

It is not a supported feature.

-- Scott