Client Authentication issue from NAT POOL

[Cantor, Scott]

On 1/13/16, 12:06 PM, "users on behalf of AdamhEdTech" <users-bounces at shibboleth.net on behalf of adam.henderson at nassau.k12.fl.us> wrote:


>
>Well you are right, I cant see layer 7 in wireshark but I see a SYN, SYN ACK
>and an ACK so I assume a session is started. 

That's a TCP session. We're talking about a web application and session means something completely  different there obviously. You can have a million TCP sessions but they're all one session with the web application because the cookie is the same. That cookie is bound to an IP address for security.

>NAT may be evil but pretty hard to avoid with 13k daily users and over 100k
>connections made at any given time.

If you asked me to allow for that in my IdP, I wouldn't even consider it. Other people are entirely welcome to make their own decisions about their IdP's security.

Does make for a fascinating case study in the whole question of IdP trustworthiness and assurance and such. If I knew an IdP was allowing unbound session cookies, I'd want to know that as an SP. ;-)

-- Scott