When reauth is needed it does not carry POST/GET variables

[Cantor, Scott]

> I have not reviewed the possibility of it being done in the
> replacement software with the Java portions, but that's
> nothing imminent.

Hit send right before I remembered the other reason I don't believe it's practical, which is that it would require getting the browser to resubmit it later, and I don't know of any way to do that by returning an HTML body to a client as is possible with a form.

It basically is an application function to handle something that complex, by capturing an unauthenticated submission, storing it in a holding pattern, and then revalidating it in some way after a login is re-established.

Nothing my code will ever be likely to take on in its Apache/IIS form. It's something more suited to SSO agents that don't manage sessions themselves and defer that to application frameworks, but either way it's nothing that would be simple to handle.

I think I've seen people do things like requiring a fresh session before the upload attempt, and the SP does export the session expiration for that purpose.

-- Scott