DataSealer dependencies

[Marvin Addison]

On Thu, Mar 10, 2016 at 9:50 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I don't see how session tracking would work without server-side storage.
> I
> > have to grab the IdPSession on the back channel in order to add the
> > CASSPSession to it. Do you see how that would work?
>
> Why wouldn't you add the session when the ticket is issued? That's how we
> do it with SAML, regardless of which binding is used.
>

That's an option, but one I deliberately avoided in the initial
implementation since the service doesn't really start a session until the
ticket is validated on the back channel. It wouldn't break the protocol to
do it on the front channel, so definitely an option, but it will have
storage consequences in practice. It's quite common for tickets to be
granted and not validated due to configuration problems and environmental
blips.

M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160310/fbc4ea47/attachment.html>