Can the _shibboleth_ credentials be transferred?

[Peter Schober]

* Daniel Södling <daniel.sodling at pdsvision.se> [2018-10-15 13:08]:
> 1. Our service is a web application running on Apache. Lets call this AppA.
> 2. We have a second web application that runs in the same Apache
>    server. Lets call this AppB.

"Same Apache server" doesn't really help much. Is it the same vhost?
By default a session cookie with a path=/ will be issued, so as long
as the applications share a vhost a single shib session will be
available for all apps to use.

> 3. The user will access the AppB which is an angualrjs driven SPA app.
> 4. Accessing AppB triggers the sign-on process via our Idp.
> 5. Once logged in the user can enter some search criteria and click on
>    a serach button which calls a cgi-script also running in the same
>    Apache.
> 6. This cgi-script will now try to call AppA using the _shibboleth_
>    cookie/token stored in the users broswer.
>
> Step 6 is where we run into problems because it seems that we cannot
> simply transer the credentials token from the users browser session
> and use it in the call from the cgiscript.

You fail to say just those problems are specifically, but having the
CGI script on the web server impersonate the subject (instead of the
script merely issuing HTTP responses to the subject's browser which
cause the browser to access AppA itself) doesn't seem right/a good
design.

-peter