Multiple IdP in a singler Server

[Matthew Slowe]

On 12/01/2017 17:09, Jim Fox wrote:
> 
> Be aware also that the privacy of cookies and web content is all about
> the domain.  All paths on the same domain share a single security space.

The IDP seems to automatically add a cookie "path" to the cookie using
the base IDP address within the "domain" (the hostname of the IDP)
meaning that multiple IDPs shouldn't be able to share cookies by
accident unless it's overridden using idp.cookie.path.

It's described at
https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration
and a quick check of the cookie being set by my IDP suggests it does
what it says on the tin :-)

Set-Cookie: JSESSIONID=<snip>; Path=/idp/; Secure; HttpOnly

The Path=/idp/ means that if you had a second IDP on /idp2/ then the
browser would keep them apart.

Regards,
-- 
Matthew Slowe | Server Infrastructure Officer
IT Infrastructure, Information Services, University of Kent
Room S21, Cornwallis South
Canterbury, Kent, CT2 7NZ, UK
Tel: +44 (0)1227 824265

www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt
PGP: https://keybase.io/fooflington

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 829 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170113/20c09aa2/attachment.sig>