<div>Gotcha.</div>
<div> </div>
<div>I'll try it out. So I need a new application for each customer. Your idea is clear. I supposed that the session cache would share entries only for the hosts/alias in the same site. </div>
<div> </div>
<div>Thanks a lot for your suggestion and for your time. (and also for the quick answer).</div>
<div> </div>
<div> </div>
<div>Eduardo.</div>
<div> <br><br></div>
<div class="gmail_quote">On Mon, Sep 12, 2011 at 10:48 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div class="im">On 9/12/11 4:43 PM, "Eduardo Fernandes" <<a href="mailto:edufer@gmail.com">edufer@gmail.com</a>> wrote:<br>><br>><br>>You're right, any browser would never do that, but a malicious<br>
>application could. In my case I built a simple application that catch all<br>>cookies, changes the url and the host header and resend it to the SP.<br>>Doing that I could access a host securized by a different IdP.<br>
<br></div>Ok. If you map both hosts to the same application in the SP, then they do<br>in fact share a session cache, so that works as intended. If you want them<br>separate, then you need to make them separate applications.<br>
<div class="im"><br>><br>><br>>What I want to do is guarantee that a resource protected by an IdP only<br>>will be accessible if the user is authenticated by this IdP. This is<br>>because, as you could imagine, private info are stored under the specific<br>
>host (virtual hosts, in my case).<br>><br>>I'm not sure if I was clear about my user case. If you think that I was<br>>not clear about the subject please let me know.<br><br></div>It's clearer now.<br>
<br>If you want to lock it down, you need separate applicationIds and you need<br>to give them metadata with only the idP you want.<br><br>You can do it by mapping one vhost to the default application and one to<br>an override, or you could map both to overrides if that's clearer to you.<br>
<div>
<div></div>
<div class="h5"><br>-- Scott<br><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></div></div></blockquote></div><br>