Session validation in Single Page Application with SP 3.0.2

[Ron Harris]

Peter,
Thanks for your response.
These APIs are protected with some Basic Authentication, but they are
exposed only over intranet.
So that is why I was looking for way that one with only valid session is
able to access them.

Thanks for the idea of going for Angular search. Going by one of the
response, using JWT Token to protect API calls.
This is what I too want to achieve.
The part where I am struggling is that how do I make the JWT token to
expire with ADFS session.
JWT will have it's own expiry time, which will be independent of ADFS
session.



On Wed, Nov 14, 2018 at 9:21 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Ron Harris <neo204011 at gmail.com> [2018-11-14 14:52]:
> > One of Our application is a Single Page Application. The URL of the
> > application is Shibboleth protected, so to access the application one has
> > to authenticate.
> > Once authenticated, Angular application gets downloaded in browser. And
> > hence it doesn't require the browser to be refresh again.
> > Angular Application calls REST APIs which are outside Shibboleth.
> >
> > This posses us with a problem where we are unable to verify if the ADFS
> > session is active or not.
>
> The "ADFS session" (I'm assuming this to mean the SSO session the
> browser has with the SAML IDP) doesn't factor into this, at least not
> until the SP's own session expires and SSO kicks in for access to
> actively protected resource. (Access to other resources will not.)
>
> > Its not possible to bring the REST APIs under Shibboleth, as other
> > applications too use them.
>
> What are these APIs protected with?
>
> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181114/8a214754/attachment.html>