Sibboleth securing various subdomains

[Cantor, Scott]

> We have 2 java web apps: app1.example.com <http://app1.example.com>
> and app2.example.com <http://app2.example.com> , both secure with
> shibboleth, app1 carries the UI (Angular 2) and some minor web services, and
> app2 has most of the business logic with rest web services developed in
> JAVA.

I believe there are fairly major disconnects in trying to use the SP with Angular, and you certainly can't use it with web services accessed from Javascript.

> So here is the deal, the user access app1, since there is no sessions it gets
> redirected to the login page, once this is done the redirection will open
> app1.example.com <http://app1.example.com> .  Now when the user wants
> to save some data, angular 2 will call a web service in app2.example.edu
> <http://app2.example.edu> , here is the issue: Since the user has only
> logged in to app1 there will be no cookie present for app2, this triggers a
> redirect that the call can't handle.

Right. So what is it you want to know?

In theory you can expand the cookie domain scope to cover both vhosts and assuming it's one server you can manage to link those up as a single session with the SP I guess, but eventually it would time out and you'd still be stuck.

Find a different solution, don't waste your time trying to make a round peg fit a square hole.

-- Scott