Session/Cookie Question

[Check]

My limited knowledge of how all this stuff works has been clouding my
view.  Scott, I think you may have finally squished it into my brain.  :)

Basically you're observing behavior from two independent software
> components (plus web servers, etc.) and ascribing all of the behavior to
> only one of them. The part you're asking about is handled by the other one.


That's the part I was confused about.

Thanks a bunch,

Robert "Check" Adamczyk


On Thu, Jan 2, 2025 at 3:46 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > it shows me the Terms of Use page. I click a checkbox, then
> > Submit, and it takes me to https://mySP.com/Page1
>
> No, "it" doesn't, that's what I keep telling you. The IdP (which is the
> "it" in this discussion) sends a SAML response to the SP's ACS location and
> then the SP does whatever it does. That's largely out of scope, both of the
> standard and certainly of the IdP.
>
> Naturally, the SP Is in most cases (assuming success) intending to recover
> the page identity and send you there, but that's nothing to do with any
> standards or defined anywhere and not part of the IdP.
>
> The only thing the IdP gets is a state token, and it returns the token.
> There is not meant to be a URL in that token, and there usually isn't.
>
> Basically you're observing behavior from two independent software
> components (plus web servers, etc.) and ascribing all of the behavior to
> only one of them. The part you're asking about is handled by the other one.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250102/329dd76d/attachment.htm>