Can the _shibboleth_ credentials be transferred?

[Jarno Huuskonen]

Hello,

On Tue, Oct 16, Daniel Södling wrote:
> Just to clarify, are you saying that the cookie that holds the credentials is is no way tied to the machine/address for which it was issued? So I should be able to take the credentials from one users machine and use it in a request form another machine to gain access to my resource? Granted that is exactly what I would like to do, I just find it surprising that it would work that way. 

Does changing consistentAddress or checkAddress to false help ?
(https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions)

-Jarno

-- 
Jarno Huuskonen