Can the _shibboleth_ credentials be transferred?

[Daniel Södling]

As far as I can tell there are no VirtualHosts explicitly configured so I assume that means that everything runs in one single vhost.

Just to clarify, are you saying that the cookie that holds the credentials is is no way tied to the machine/address for which it was issued? So I should be able to take the credentials from one users machine and use it in a request form another machine to gain access to my resource? Granted that is exactly what I would like to do, I just find it surprising that it would work that way. 

For the record you are absolutely correct when you say that our current design is not a good one and hopefully I will be able to fix this at some point. 
This is a legacy system that we as of yet have not had time to change and when this is run in a setting where basic auth is used we are able to extract the credentials and login again from the cgi scripts thus allowing us to do what we need.


Daniel Södling, Software Development Manager
___________________________________________





Stora Åvägen 19B | SE-433 36 Askim | SWEDEN
Phone: +46 (0) 767 899949
www.pdsvision. <x-msg://16/www.pdsvision.com>se
___________________________________________




> On 15 Oct 2018, at 14:23, Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> * Daniel Södling <daniel.sodling at pdsvision.se> [2018-10-15 13:08]:
>> 1. Our service is a web application running on Apache. Lets call this AppA.
>> 2. We have a second web application that runs in the same Apache
>>   server. Lets call this AppB.
> 
> "Same Apache server" doesn't really help much. Is it the same vhost?
> By default a session cookie with a path=/ will be issued, so as long
> as the applications share a vhost a single shib session will be
> available for all apps to use.
> 
>> 3. The user will access the AppB which is an angualrjs driven SPA app.
>> 4. Accessing AppB triggers the sign-on process via our Idp.
>> 5. Once logged in the user can enter some search criteria and click on
>>   a serach button which calls a cgi-script also running in the same
>>   Apache.
>> 6. This cgi-script will now try to call AppA using the _shibboleth_
>>   cookie/token stored in the users broswer.
>> 
>> Step 6 is where we run into problems because it seems that we cannot
>> simply transer the credentials token from the users browser session
>> and use it in the call from the cgiscript.
> 
> You fail to say just those problems are specifically, but having the
> CGI script on the web server impersonate the subject (instead of the
> script merely issuing HTTP responses to the subject's browser which
> cause the browser to access AppA itself) doesn't seem right/a good
> design.
> 
> -peter
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181016/4743fbb5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 1926 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20181016/4743fbb5/attachment.jpg>