Thank you Peter for confirming my suspicions. I will take this into consideration when moving forward.<div><br></div><div>Kind regards,</div><div>Jonas</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Dec 14, 2012 at 1:48 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> [2012-12-14 13:42]:<br>
<div class="im">> * Jonas Dehlin <<a href="mailto:jonas.dehlin.crap@gmail.com">jonas.dehlin.crap@gmail.com</a>> [2012-12-14 13:29]:<br>
> > Essentially, what I need to do is make a lookup for the attribute<br>
> > value for each incoming request since I always need the latest<br>
> > value.<br>
><br>
> I don't think the software allows to do this today.<br>
<br>
</div>More to the point: Once the session is gone either active protection<br>
of the SP kicks in (if used) or you end up at the resource unauthenticated.<br>
<br>
Once a new session is initiated the standard SSO flow begins and a new<br>
session gets established (whether that involves attribute queries or<br>
not is immaterial here), replacing whatever was there before wholesale.<br>
<br>
So I don't think the existing architecture can do what you want.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>