<div dir="ltr">Hi Peter,<div><br></div><div>I read that setting "Domain=.<a href="http://domain.com">domain.com</a>;" as a cookie property may get what I want as these share a common top-level domain? Then I might just need to associate multiple ACS endpoints with my relying party?</div>
<div><br></div><div>For the active/passive I meant application initiated auth vs shibboleth initiated. One particular site(the IIS) site uses multi-factor authentication as well.. We may be able to modify this though to just accept the shibboleth authenticated connection and then prompt for the token before the application session is initiated.</div>
<div><br></div><div>-Greg</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 13, 2014 at 11:40 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Greg Zapp <<a href="mailto:greg.zapp@gmail.com">greg.zapp@gmail.com</a>> [2014-06-13 01:11]:<br>
<div><div class="h5">> I was hoping this might be a good place to get some clarification on what's<br>
> possible... I've got some internal tools spread out across at least two<br>
> servers on different subdomains of a common top level. Let's call them<br>
> <a href="http://foo.domain.com" target="_blank">foo.domain.com</a>, <a href="http://bar.domain.com" target="_blank">bar.domain.com</a>, <a href="http://fuzz.domain.com" target="_blank">fuzz.domain.com</a> . One server is IIS and<br>
> the other apache2 on linux(Ubuntu 12.04). The idP will be ADFS supporting<br>
> SAML2. My question is whether I can have these logically as a single<br>
> "application", and also be able to navigate between sites seamlessly after<br>
> a single authentication. I'm looking to use passive on the IIS site and<br>
> active on the others... Is this possible? Reading the documentation I'm a<br>
> bit unclear as to what would happen if the user crossed domains. Can the<br>
> authentication information in the cookie be validated with the idP<br>
> seamlessly if the "session" isn't in the SP's cache?<br>
<br>
</div></div>There is not "the cookie", each webserver creates and maintains it's<br>
own. The Shib SP (assuming you're asking about this, otherwise this is<br>
all off-topic here given that the IDP also is non-Shibboleth) has it's<br>
own session and so will the SAML IDP (though I don't know the<br>
implementation you mentioned myself).<br>
<br>
Whenever the user agent moves from one vhost/serevr/fqdn to another,<br>
the subject (or server) will need to initiate a login in order to be<br>
authenticated, as session cookies are scoped to the server name by<br>
default, i.e., the user agent will not transfer HTTP cookies to<br>
another FQDN. Due to SSO the user agent has with the SAML IDP this<br>
should not cause too much effort for subjects, though.<br>
<br>
Since you mention "passive" and "active" together with "ADFS" I'm<br>
guessing this is M$ terminology for the SAML "Web Browser SSO" profile<br>
("passive") and SAML "ECP" profile ("active")? I.e., the client for<br>
some of those resources is /not/ a web browser?. In such a scenario<br>
there's no SSO possible across all resources, of course, as there are<br>
several clients involved, each having their own sessions with all<br>
involved servers (and their own cookie store to reference those<br>
sessions).<br>
Or did you mean "active" as in web server enforced protection (httpd<br>
'require' directives) and "passive" as what Shibboleth calls "lazy<br>
sessions" (session establishement not enforced by the webserver but<br>
initiated by the application once deemed necessary)?<br>
<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>