Client persistent storage not remembering user

[Cantor, Scott]

> I implemented a new login flow for the remember me feature i wanted to
> create in shibboleth. But that is only the first part of what i want to achieve.
> That is the first part is : reading the cookie and verifying its content. That use
> a database to read some information and check the cookie has not been
> stolen (same implementation as Spring Security Persistent token approach).
> Well i just read the fact that using StorageService would be better than jdbc
> to store this informations, but that is another story.

That's frankly nuts. You should use the DataSealer class built into the IdP and just write a secure cookie. Using a database for this has only one advantage, the ability to invalidate specific sessions, but that pales in comparison. It trades a rare issue that can be worked around for a lack of reliability for everybody on a daily basis.

> Now the second part : i want to create the cookie after the Password flow
> succeed. I don't know exactly where i should insert this part. Can you point
> me at the documentation i should read to do that ?

I'd use a post-authentication interceptor flow, probably.

-- Scott