Client persistent storage not remembering user

[Thomas Colin de Verdière]

Yes the point of the approach is avoiding stolen cookie.
What do you mean by a lack of reliability ? You mean a bad reliability if
the database shutdown or has too much load ?

> I'd use a post-authentication interceptor flow, probably.
Thanks for this valuable information.


2018-04-25 19:52 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> > I implemented a new login flow for the remember me feature i wanted to
> > create in shibboleth. But that is only the first part of what i want to
> achieve.
> > That is the first part is : reading the cookie and verifying its
> content. That use
> > a database to read some information and check the cookie has not been
> > stolen (same implementation as Spring Security Persistent token
> approach).
> > Well i just read the fact that using StorageService would be better than
> jdbc
> > to store this informations, but that is another story.
>
> That's frankly nuts. You should use the DataSealer class built into the
> IdP and just write a secure cookie. Using a database for this has only one
> advantage, the ability to invalidate specific sessions, but that pales in
> comparison. It trades a rare issue that can be worked around for a lack of
> reliability for everybody on a daily basis.
>
> > Now the second part : i want to create the cookie after the Password flow
> > succeed. I don't know exactly where i should insert this part. Can you
> point
> > me at the documentation i should read to do that ?
>
> I'd use a post-authentication interceptor flow, probably.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180425/ec8ba99b/attachment.html>