Joint SP configuration for two applications- attributePrefix conflict

[Cantor, Scott]

On 11/23/16, 10:15 PM, "users on behalf of Alexander Ivanov" <users-bounces at shibboleth.net on behalf of alex at calmforce.com> wrote:

> So, the host-only session cookies present a challenge.  Our two sites are on the same host, different subdomains. 
> Our ultimate goal is that when the user logs into Site A (through Shibboleth) and then navigates to Site B, Site B
> recognizes that the user was previously authenticated and the user does not have to click Login again to make
> the round-trip to the IdP.

One way you haven't looked at is IsPassive. If you wanted to, your application could issue a passive login request to the IdP and if the user's already logged in, it will be seamless. With the Shibboleth SP, that's just a simple redirect to /Shibboleth.sso/Login?isPassive=1

Personally I think that's better than shared cookies, and I know it's better than building a whole other layer of SSO into the system, but it's your choice.

-- Scott