<div>Hi. </div>
<div> </div>
<div>Thanks for your answer. </div>
<div> </div>
<div>You're right, any browser would never do that, but a malicious application could. In my case I built a simple application that catch all cookies, changes the url and the host header and resend it to the SP. Doing that I could access a host securized by a different IdP. </div>
<div> </div>
<div>What I want to do is guarantee that a resource protected by an IdP only will be accessible if the user is authenticated by this IdP. This is because, as you could imagine, private info are stored under the specific host (virtual hosts, in my case).</div>
<div> </div>
<div>I'm not sure if I was clear about my user case. If you think that I was not clear about the subject please let me know.</div>
<div> </div>
<div>Many thanks again for your help.</div>
<div> </div>
<div>Eduardo.</div>
<div><br><br> </div>
<div class="gmail_quote">On Mon, Sep 12, 2011 at 10:34 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class="gmail_quote">
<div class="im">On 9/12/11 4:21 PM, "Eduardo Fernandes" <<a href="mailto:edufer@gmail.com">edufer@gmail.com</a>> wrote:<br>>After that I have in my browser, among other cookies, the Shibboleth<br>>session cookie. So now I send all the cookies I got from the previous<br>
>authentication to other site:<br>><br>>http get <a href="https://host2.mydomain.com/resource.html" target="_blank">https://host2.mydomain.com/resource.html</a> -> go to the resource<br>>ok. In my config file I setup that hosts2 should be securized using idp2<br>
>but no authentication is required.<br><br></div>That isn't possible, so you are mistaken about what you actually set up or<br>what cookies existed. Any of the cookies the SP sets are per-host by<br>default and will not work across hosts.<br>
<div class="im"><br>><br>>Is there a way to oblige Shibboleth SP to force authentication even if I<br>>resent cookies, etc to hosts2?<br><br></div>It didn't and doesn't resend them.<br><br>-- Scott<br><font color="#888888"><br>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></font></blockquote></div><br>