availability of "PrivateCredentials" beyond initial login event

[Liam Hoekenga]

Why is it that when shibboleth.authn.Password.RetainAsPrivateCredential is
enabled, the password remains available after the initial authentication
event, but with shibboleth.authn.Krb5.PreserveTicket, the TGT is only
available during the initial event?

I see the note in
https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition

    "A variable named subjects, an array of the java
javax.security.auth.Subject
    objects associated with this authorization.  Note that these will only
be present
    if the attribute resolution has been associated with an act of
authentication
    (and so this will not work for back channel requests)."

I know that keeping the user's credential (for replay?) stashed in their
session isn't the best of ideas... but I'd think that the TGT might be
safer to store than the password (since TGTs expire).

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170428/3472eb57/attachment-0001.html>