Switching to HTML Local Storage for Sessions--Any Issues?

[Andrew Morgan]

You can (probably) get by without server-side storage for CAS as well. 
Marvin wrote a feature, kinda due to my request, to generate CAS Service 
Tickets that are stateless.  They work by encoding the necessary 
information into the Service Ticket itself.

You can see the work around it here:

   https://issues.shibboleth.net/jira/browse/IDP-1018

We are looking hard at implementing this change in December.  The only 
issue I've seen so far is that phpCAS clients require a configuration 
change.  By default, phpCAS tries to use the Service Ticket as the PHP 
session ID.  However, these encoded STs are quite long (mine were around 
350 characters).  Sometimes you can't have a PHP session ID that long, 
such as when sessions are stored in the filesystem.  I've been able to 
work around that by telling phpCAS not to switch the session ID.  See the 
documentation for initializing the phpCAS client.

Thanks,
 	Andy


On Wed, 8 Nov 2017, Domingues, Michael D wrote:

> SAML logout works fine with client-side storage, at least using HTML Local Storage.
>
> CAS, however, does require shared server-side storage [1].
>
> Michael
>
> [1] https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=18088614
> ________________________________
> From: users <users-bounces at shibboleth.net> on behalf of Liam Hoekenga <liamr at umich.edu>
> Sent: Tuesday, November 7, 2017 4:00:34 PM
> To: Shib Users
> Subject: Re: Switching to HTML Local Storage for Sessions--Any Issues?
>
> Aren't (weren't?) there certain features that require server-side storage (CAS?  logout?)?
>
> Liam
>
>
> On Tue, Nov 7, 2017 at 3:02 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
>>  The docs for the option provide a mixed-message stating
>> that the devs have "relatively little experience with use of Local Storage" and
>> "OSU has been using this for [1 year] without issues."
>
> I've removed the warnings and notes about it, there's no reason to be scaring anybody off. Compared to a database or memcache, I'd trust this orders of magnitude more.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
>
>