Cookie Encryption Key

[Ramon Pfeiffer]

On 18.07.2017 17:35, Cantor, Scott wrote:
> On 7/18/17, 3:33 AM, "users on behalf of Ramon Pfeiffer" <users-bounces at shibboleth.net on behalf of ramon.pfeiffer at uni-tuebingen.de> wrote:
> 
>> I'm planning to set up my IdP in an active-passive clustered
>> environment. I've stumbled over the Cookie Encryption Key [1] and the
>> recommendation to regularly recycle it.
> 
> That isn't exactly hard, but...
> 
>> For the generation of persistent IDs, I use a StoredPersistentIdGenerator. I don't want to allow attribute queries via
>> transient ID.
>> According to the wiki, I can then disable the use of the cookie
>> encryption key [2]. Did I miss anything?
> 
> Yes, sessions. That's its primary function, client side sessions. It has nothing to do with persistent ID handling, I don't know where you're getting that. It does get used for query support, yes, but that's generally a non-issue now.

Ah yes, sessions. I have set the idp.session.StorageService property to
the same storage as the persistent ID storage.

Am I correct that the sessions of a user are then stored in the backing
storage so that it will survive a failover between my two nodes?

What do you mean by "that's generally a non-issue now"?

Thanks
Ramon


--
Universität Tübingen
Zentrum für Datenverarbeitung
Wächterstraße 76
72074 Tübingen

E-Mail: ramon.pfeiffer at uni-tuebingen.de
Telefon: +49-7071-29-70213

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5217 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170719/e8e0e356/attachment.p7s>