[External] Re: Idp v3.46 with Unicon's Shib-Redis storage service

[Cantor, Scott]

On 9/16/20, 3:24 PM, "users on behalf of Paul B. Henson" <users-bounces at shibboleth.net on behalf of henson at cpp.edu> wrote:

> In terms of full disclosure, without shared server-side storage you also lose out on replicating the replay cache between
> nodes, as well as no longer have the ability to configure a ticket as "single use only", it will be valid until it is expired.
> Unless you have some strict security requirements regarding those components though, the decrease in complexity and
> increase in reliability is totally worth it.

Thanks for elaborating.

I would add that my real/chief concern is OIDC's misguided obsession with the back channel, and the assumption that the future trends will force people back to server state. I don't have a good answer to that problem, because in my observing 20 years of this, nobody has ever made it work reliably beyond the isolated case here and there.

It's always "it works great except when it doesn't". I don't personally have any freaking time for "except when...", I don't want to be paged at 2am because of software I didn't write.

-- Scott