idp RemoteUser url-parameters jsession occasional-login-failures

[Cantor, Scott]

> and that's OK, but some clients (I think it's the clients) gratuitously add that
> parameter to the next redirect

It's the server. Standard container behavior when creating the Java session is to drop a cookie and include the value in the redirect URL, and once the cookie comes back, it detects that and knows not to continue adding the parameter.

I believe containers can be taught to skip the URL rewrite when the goal isn't to accomodate clients without cookies. I have this in web.xml:

   <!-- Tell container not to attack jsessionid to URL. -->
   <session-config>
      <tracking-mode>COOKIE</tracking-mode>
   </session-config>

I don't know that I've verified that it actually honors it.

-- Scott