Shibboleth integration with external idp and java ee/.Net application

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2017-03-16 21:38]:
> > How is it possible that the idp detects that the user has already
> > been indentified on it's own system ? My guess was that a cookie was
> > set on the idp domain with the session id.
> 
> Yes, but what the IDP does to recognize the subject is not specified
> by SAML).

Also, there's no need to set an HTTP Cookie "on the idp domain" (as in
a cookie any host sharing a DNS domain with the IDP can read), only a
cookie for the FQDN of the IDP itself suffices.
The IDP is the one setting the cookie, and the IDP is the only one
needing to read it back from the HTTP User Agent.
-peter