SSO Session Cookies

[Jeff Chapin]

Ok, on a related note, we run multiple shibboleth silos -- this may not be
the best way to do things, but we have a separate silo for running CAS on
shibboleth, as well as our federated logins, and our unfederated -- this
was a management decision, that I did not have much say in.

We would *LIKE* to have each of these silos share SSO cookies with each
other -- so if you log into one, you are not re-prompted on another. We
currently do this by having everything use the same external CAS server and
authn/External. We would *LIKE* to move everything to authn/Password, and
have each silo do it's own authentication, but use a shared cookie -- is
this even possible? At one point, I had it working, but that was several
years ago, and we are just now getting to the point of implementation.

Thanks,
Jeff

On Wed, Feb 21, 2024 at 8:56 AM Jeff Chapin <jeff.chapin at uni.edu> wrote:

> As usual, I got an answer that got me moving forward very quickly --
> setting the cookie path to / seems to have changed the behavior. I am now
> testing this change more fully, but a 3 minute response time (with the
> correct fix included) is *DAMN* impressive.
>
> Thanks!
>
> On Wed, Feb 21, 2024 at 8:50 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> Off the top of my head, turning sessions off outright (common when
>> proxying) would do it, as would using a new install that defaults to a
>> __Host- prefixed cookie, which requires the path be set to /, which is also
>> the OOB default now.
>>
>> -- Scott
>>
>>
>>
>
> --
>
> Jeff Chapin,
>
> Panther eSports Adviser
> Systems/Applications Administrator
> ITS-IS, University of Northern Iowa
> Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
>


-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240221/6200a5e3/attachment.htm>