Cookie Encryption Key

[Cantor, Scott]

On 7/18/17, 3:33 AM, "users on behalf of Ramon Pfeiffer" <users-bounces at shibboleth.net on behalf of ramon.pfeiffer at uni-tuebingen.de> wrote:

> I'm planning to set up my IdP in an active-passive clustered
> environment. I've stumbled over the Cookie Encryption Key [1] and the
> recommendation to regularly recycle it.

That isn't exactly hard, but...

> For the generation of persistent IDs, I use a StoredPersistentIdGenerator. I don't want to allow attribute queries via
> transient ID.
> According to the wiki, I can then disable the use of the cookie
> encryption key [2]. Did I miss anything?

Yes, sessions. That's its primary function, client side sessions. It has nothing to do with persistent ID handling, I don't know where you're getting that. It does get used for query support, yes, but that's generally a non-issue now.

-- Scott