<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jan 17, 2014 at 1:28 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 1/17/14, 1:55 PM, "Joseph Areeda" <<a href="mailto:jareeda@exchange.fullerton.edu" target="_blank">jareeda@exchange.fullerton.edu</a>><br>
wrote:<br>
><br>
>The problem occurs when one page has multiple images and the user does<br>
>not yet have a session with the SP. The best we can determine the<br>
>problem is browsers open all the links in parallel and the SP is unable<br>
>to actually get a session. Usually the wiki page being opened has<br>
>established a session with the same IdP so there's no user interaction<br>
>to create the SP's session.<br>
<br>
There's no way to do that unless the surrounding page ensures a session is<br>
in place, that's true with all SSO systems unless the authentication<br>
mechanism is known to the browser and not a form.<br>
<br>
>Does anyone have a suggestion for how to better deal with this problem?<br>
<br>
Well, yes, you can't do this. The protected resource needs to host the<br>
surounding HTML, not something else. Or you proxy it.<br>
<br></blockquote><div><br></div><div>One can help mitigate the issue by configuring the SP serving the protected images to prefer the artifact resolution profile. </div><div><br></div><div>With that configuration the background thread(s) doing the GET to retrieve the image will, for some browsers, follow the 302 redirects and continue to follow them since no POST is (usually) encountered as part of the flow. </div>
<div><br></div><div>It requires, of course, that the IdP support artifact resolution. </div><div><br></div><div>We have used this in the LIGO project to help mitigate the problem since most users are using the LIGO IdP and it supports all backchannel operations. It is not perfect since it does not work for all browsers and, as you might expect, multiple browser threads can cause multiple SP sessions to be created. We do not have enough users that the many sessions exhaust the SP.</div>
<div><br></div><div>Fundamentally the issue is as you state it and ideally the users would not use the wiki in this way, but that is a foregone conclusion now.</div><div><br></div><div>Scott K for LIGO</div></div></div></div>