> So could you please tell me hows shibboleth verifies the existing session > which makes SSO work . This isn't about the session, it's a question of selecting authentication flows and determining when previous results are sufficient to satisfy a request. That's documented in the wiki. -- Scott