follow up question<div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><br><br></blockquote><div class="gmail_quote">On Tue, Dec 11, 2012 at 4:06 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 12/11/12 6:29 PM, "Anand Somani" <<a href="mailto:meatforums@gmail.com">meatforums@gmail.com</a>> wrote:<br>
><br>
>If I have no clustering between my multiple IDP instances (want to treat<br>
>them as stateless), do I risk a login failure if the login happens on 1<br>
>instance and the SAMLAssertion generation happens on another (due to<br>
>redirect)?<br>
<br>
</div>Yes. You cannot do this without a sticky load balancer. If you want<br>
something else, you need Terracotta or your own storage service.<br></blockquote><div><br></div><ul><li>thanks, that is good to know, saved me some headache.</li><li>But this means there is some state which is identified by something set in the cookie and I suppose this uses a more secure random key?</li>
<ul><li>Cause in theory I login as "joe" and I get redirected for getting Assertion, but if somebody "tom" else guesses that key and is able to get (by injecting between this redirect, from another bot) the assertion and redirect and now the SP lets in "tom" as "joe" - is this not possible?</li>
</ul></ul><div> Thanks</div><div>Anand</div></div></div>