What does donotcache flag do ?

[Cantor, Scott]

On 9/17/16, 2:58 AM, "users on behalf of Shagun Akarsh" <users-bounces at shibboleth.net on behalf of shagun.akarsh at wooqer.com> wrote:

> So does this means 
>    a) donotcache enables/disable SSO as per user request. (donotcache=true --> SSO
> disabled, donotcache=false --> SSO enabled)

SSO is a secondary behavior of the system. The flag controls whether the result of the authentication process is cached within the IdP session with the client so that it can be recovered by a subsequent request. If it isn't cached, then SSO becomes impossible, but that's a secondary result.

The indicator is not user request, it's whether the form field is set. Whether the user's choice is the reason it wasn't set is a separate matter. If it was set as a hidden field based on the IP address of the client, for example, then the user wouldn't have anything to do with it. Likewise, flows like External can signal it themselves.

> b) it caches the authentication success/failure (increases shib_idp_session timeout) thus
> not prompting login screen for next application trying to authenticate using IdP,
> something similar to remember me. If yes then for what time ? (Switch aai

I don't understand why you're suggesting that means something different. Neither does this have anything to do with timeouts, nor does "shib_idp_session" mean anything to me.

-- Scott