SSO Session Cookies

[Jeff Chapin]

We currently have the same  domain -- all the hosts are inside uni.edu, and
the cookie domain is set to uni.edu, and the sealer.jks on all the nodes
has the same md5sum. Is there another setting/thing to check that I am
missing?

Thanks,
Jeff

On Wed, Feb 21, 2024 at 12:03 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > We would *LIKE* to move everything to authn/Password, and have each
> > silo do it's own authentication, but use a shared cookie -- is this even
> > possible? At one point, I had it working, but that was several years
> ago, and
> > we are just now getting to the point of implementation.
>
> Yes, if there's a common domain (because we use client side storage for
> sessions), but you'd have to make sure they're all sharing the same secret
> key (not private key, this is the sealer key internal to the IdP), and then
> change the cookie settings to get the session cookie scoped broadly enough.
>
> Notably, doing that generally opens you up to fairly broad exposure of the
> cookies across the whole domain, which is one of the reasons I react so
> badly to attempts to break the use of client addresses to bind sessions.
>
> When that becomes impossible thanks to Google, Apple, and all of our
> NAT-obssessed network engineers, the security of SSO sinks to levels I
> personally would not want to be responsible for.
>
> -- Scott
>
>
>

-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240221/6bbcf3f2/attachment.htm>