SSO Session Cookies

[Cantor, Scott]

> We would *LIKE* to move everything to authn/Password, and have each
> silo do it's own authentication, but use a shared cookie -- is this even
> possible? At one point, I had it working, but that was several years ago, and
> we are just now getting to the point of implementation. 

Yes, if there's a common domain (because we use client side storage for sessions), but you'd have to make sure they're all sharing the same secret key (not private key, this is the sealer key internal to the IdP), and then change the cookie settings to get the session cookie scoped broadly enough.

Notably, doing that generally opens you up to fairly broad exposure of the cookies across the whole domain, which is one of the reasons I react so badly to attempts to break the use of client addresses to bind sessions.

When that becomes impossible thanks to Google, Apple, and all of our NAT-obssessed network engineers, the security of SSO sinks to levels I personally would not want to be responsible for.

-- Scott